Overview
Prompt jailbreaking refers to bypassing an LLM's safety alignment and content filtering policies through carefully constructed input, causing the model to perform actions that were originally prohibited. Unlike prompt injection, the goal of jailbreak is todirectly manipulate the model's own behavioral boundaries。
In-Depth References
- Detailed payloads for various jailbreak techniques (role-playing/encoding/multilingual/context/advanced techniques) → references/jailbreak-techniques.md
- Bypass cases, real-world prompt templates, key points for bypassing defenses → references/bypass-templates.md
Core Classification
| Category | Principle | Success Rate | Applicable Models |
|---|---|---|---|
| Role-Playing | Get the model to adopt a fictional role to bypass alignment | ★★★★ | GPT/Claude/open-source |
| Encoding Bypass | Use encoding to hide sensitive keywords | ★★★ | GPT/open-source (Claude is stronger) |
| Multilingual Switching | Exploit weaknesses in non-English alignment | ★★★★ | Models with strong English alignment |
| Context Overflow | Long text dilutes the weight of safety instructions | ★★★ | Models with large context windows |
| Logical Chain Escalation | Gradually escalate requests through multi-turn dialogue | ★★★★★ | All models |
| System Prompt Override | Directly claim to have higher privileges | ★★ | Simply deployed applications |
| Virtualized Nesting | Claim to be running in a virtual machine/simulator | ★★★ | GPT/open-source |
| Adversarial Suffix | Automatically searched adversarial token sequences | ★★★★ | Open-source models |
Methodology Overview
Phase 1: Role-Playing Jailbreak
- DAN (Do Anything Now): Create an unrestricted AI persona, reinforced with a token penalty system
- Developer/Debug Mode: Claim the model has entered developer mode
- Evil Confidant: Have the model play the "evil advisor"
- Translator/Educator: Use legitimate purposes (research/teaching) to bypass
Phase 2: Encoding/Format Bypass
- Base64 / ROT13 encoding to hide sensitive instructions
- Unicode homoglyph substitution to bypass keyword filtering
- Tokenization interruption (W-E-A-P-O-N)
- Code mode (have the model "complete" a function implementation)
Phase 3: Multilingual Switching
- Low-resource language attacks (Zulu/Swahili and other languages with weak alignment)
- Mixed languages / translation chains
Phase 4: Context Window Attacks
- Long-text dilution (malicious instructions interspersed within 5000+ characters of benign text)
- System Prompt Weight Decay
- Few-shot poisoning
Phase 5: Logical Chain Escalation (Multi-turn Jailbreak)
- Gradual escalation: Gradually escalate from harmless questions to sensitive requests (highest success rate)
- Hypothetical scenarios: Construct legitimate testing scenarios
- Socratic questioning: Guide through a teaching approach
Phase 6: System Prompt Override
- Direct override (forging [SYSTEM] messages)
- JSON/XML format injection
- Markdown format injection
Phase 7: Advanced Techniques
- Token smuggling (exploiting tokenizer differences)
- Adversarial suffix GCG Attack (gradient search)
- Virtualization/emulator jailbreak
- ASCII Art steganography
For detailed payloads and examples of all techniques, see references/jailbreak-techniques.md
Reference Resources
- OWASP LLM Top 10 — LLM01: Prompt Injection
- Jailbreak Chat — Community-collected jailbreak prompts
- LLM Guard — LLM security protection library
- HackAPrompt — Prompt Injection competition papers
- GCG Attack Paper — Universal and Transferable Adversarial Attacks
- PAIR: Prompt Automatic Iterative Refinement — Automated jailbreaking