LLM Jailbreaks Guide: Techniques, Detection, Defence

A jailbreak is an input crafted to make a large language model ignore its safety training or its operator's rules, and every model that ships with refusals has been jailbroken in public at some point. For a business the question is not whether a determined user can make a model say something it should not, but what that achieves inside your application: offensive output under your brand, a chatbot that "agrees" to commitments, leaked system prompts, or an agent that takes actions it should have refused. This guide explains the main jailbreak technique families at the level defenders need (no working prompts), how jailbreaks differ from prompt injection, where content screening should take place, the layered defences that research and vendors have measured, and how to detect and measure attempts. It is written for application security, AI platform and trust and safety teams. Injection through documents, emails and tools is covered in the Prompt Injection Guide; this page focuses on attacks on the model's safety behaviour.

Key takeaways

Jailbreaking is a form of prompt injection aimed at safety. OWASP's LLM01:2025 describes jailbreaking as prompt injection that makes the model disregard its safety protocols entirely; MITRE ATLAS tracks it as AML.T0054 LLM Jailbreak.
Techniques come in families, not lists. Persona and role-play, rule reframing, multi-turn escalation, many-shot examples, obfuscation, optimised adversarial strings, multimodal inputs and weight modification. New named jailbreaks are usually variants of these.
Screen on both sides of the model. Input classification, output classification and abuse monitoring outside the model consistently beat relying on the model's own training; Anthropic reports input and output classifiers cut jailbreak success in its tests from 86% to 4.4%.
Enforce authority in the application, not the prompt. What a chatbot can promise and what an agent can do must be decided by code and permissions, because the system prompt can be argued with.
Measure it like any other attack. Track attempt rates, classifier block rates, false refusals and red team success rates per release, and re-test after every model or prompt change.

Jailbreaks versus prompt injection

OWASP's Top 10 for LLM Applications 2025 notes that the two terms are often used interchangeably, and treats jailbreaking as a type of prompt injection in which the attacker causes the model to disregard its safety protocols entirely. OWASP adds that system prompts and input handling help against prompt injection, but effective prevention of jailbreaking requires ongoing updates to the model's training and safety mechanisms. NIST AI 600-1 defines jailbreaking as manipulating prompts to circumvent output controls.

Aspect	Jailbreak	Prompt injection (indirect)
Who supplies the input	Usually the user talking to the model	A third party, through content the model reads
Target	The model's safety training and the operator's content rules	The application's instructions, data and tools
Typical outcome	Disallowed content, system prompt disclosure, off-brand behaviour	Data exfiltration, unauthorised tool calls, manipulated answers
ATLAS technique	AML.T0054 LLM Jailbreak	AML.T0051 LLM Prompt Injection
Main defence	Model safety training plus input and output classifiers and monitoring	Privilege separation, content isolation, tool permissions

The two combine. An injected instruction in a web page often includes jailbreak techniques so that the model follows it, and a jailbroken agent is far easier to steer through injection. Defences must cover both.

Jailbreak technique families

The table groups published techniques by how they work. It is descriptive, so defenders can recognise patterns and test for them; it deliberately contains no prompt text.

Family	How it works	Public example	What helps most
Persona and role-play	Asks the model to adopt a character or fictional frame in which the rules supposedly do not apply	Widely shared "act as" prompts	Safety training; output classification on the content, whatever the framing
Rule reframing	Persuades the model to keep answering but add a warning, or to treat the request as authorised research	Microsoft's Skeleton Key (June 2024), which made affected models add a warning instead of refusing	Input filtering, system message rules, output filtering, abuse monitoring
Multi-turn escalation	Starts with harmless questions and escalates step by step, building on the model's own previous answers	Crescendo (Russinovich, Salem and Eldan, arXiv 2404.01833)	Conversation-level classification, not single-message checks
Many-shot	Fills a long context with many fabricated dialogues in which an assistant complies, then makes the real request	Anthropic's many-shot jailbreaking research (April 2024), tested up to 256 dialogues	Classifying and modifying prompts before the model; context limits where acceptable
Obfuscation and encoding	Hides the request through encodings, translation into low-resource languages, misspelling or splitting it across parts	Catalogued as AML.T0068 LLM Prompt Obfuscation	Classifiers that normalise or decode input; output checks
Optimised adversarial strings	Uses automated search to find token sequences that push a model towards compliance	Academic optimisation attacks on open models, some of which transfer to others	Perplexity and anomaly detection on input; classifiers; rate limits on automated probing
Multimodal	Carries the instruction in an image, audio or document rather than text	Crescendo authors report it also works on multimodal models	Screen extracted text and the content of images and files, not only the chat box
Weight modification	Removes refusal from open weights by fine-tuning or editing	Uncensored and abliterated models	Model provenance and allow-listing; see the Uncensored and Abliterated AI Models guide

Two research results matter for planning. Anthropic found that many-shot jailbreaking becomes more effective as context windows grow and works better on larger models, and that fine-tuning the model against it only delayed success, while classifying and modifying prompts before they reached the model reduced success in one case from 61% to 2%. Crescendo showed that checking messages one at a time misses attacks that are spread across a conversation.

What a jailbreak achieves in a real application

Brand and content harm: in the DPD chatbot incident in January 2024, a customer got the parcel firm's AI chatbot to swear and criticise the company; DPD blamed an error after a system update and disabled the AI element.
Unauthorised commitments: in the Chevrolet dealer chatbot case, a user manipulated a dealer's chatbot into "agreeing" to sell a vehicle for $1. No sale was honoured, but it shows a model's words being treated as the business's.
Liability for what the bot says: the Air Canada chatbot ruling held the airline responsible for its bot's wrong answer, which is why output controls matter even without an attacker.
System prompt disclosure: jailbreaks are a common route to extracting system prompts, so never put secrets, credentials or authorisation logic in them (OWASP LLM07:2025 System Prompt Leakage).
Agent misuse: a jailbroken agent may run tools or reveal data its policy forbids. Authority must sit in the tool layer, not the prompt.
Dangerous content: for general-purpose assistants, the concern is uplift on high-harm topics. NIST AI 600-1 lists CBRN information and dangerous, violent or hateful content among its generative AI risk categories.

Where content screening should take place

Screening belongs at every boundary where untrusted content enters the model or where model output leaves it, and in a monitoring layer that watches behaviour over time. No single point is enough.

Layer	What it checks	Strengths	Limits
Input classifier	User prompt, conversation history, uploaded files and retrieved content before the model sees them	Stops many known patterns cheaply; can modify or reject prompts	Misses novel and multi-turn attacks if it checks single messages
System message and model training	Rules the model is asked to follow; provider safety training	Always present; handles many casual attempts	Can be argued with; the target of every jailbreak
Output classifier	The model's response before it is shown, stored or acted on	Catches harmful output regardless of how it was elicited	Adds latency; streaming output needs incremental checks
Tool and action gate	Every tool call an agent proposes, checked against policy and permissions	Turns a successful jailbreak into a blocked action	Needs well-defined permissions per tool
Abuse monitoring	Patterns across conversations, users and time	Detects campaigns and repeat offenders; separate from the model, so less exposed to the same manipulation	After the fact; needs review capacity

Microsoft's Skeleton Key guidance recommends exactly these layers: input filtering, a system message that tells the model to resist attempts to undermine its safety instructions, output filtering, and abuse monitoring by a separate detection system trained on adversarial examples. Anthropic's Constitutional Classifiers (February 2025) are input and output classifiers trained on synthetic data generated from a written constitution of allowed and disallowed content. In Anthropic's automated test of 10,000 jailbreak prompts, success fell from 86% without classifiers to 4.4% with them, for a 0.38% rise in refusals and 23.7% more compute. In its later public demo, one universal jailbreak was found among 339 participants. Classifiers reduce risk sharply; they do not eliminate it.

For more on screening tools, see the AI Guardrails and AI Firewalls Guide.

Choosing defences for your application

Internal assistant on a hosted model: rely on the provider's safety training and built-in jailbreak filters (for example Azure AI Content Safety Prompt Shields, which Microsoft enables by default for some catalogue models), add output filtering for your own content rules, and log conversations for abuse monitoring.
Public chatbot: add input and output classifiers you control, narrow the bot's topic, hard-code what it may promise in application logic, rate-limit by user, and keep a human escalation path.
Agent with tools and credentials: treat jailbreak as expected. Gate every tool call, give the agent least-privilege, short-lived credentials, and require confirmation for high-impact actions. See the Agent Identity and Access Guide.
Self-hosted open-weight model: there is no provider safety layer, so external input and output classifiers are mandatory, and model provenance matters. See the Open-Weight Model Security Guide.
Small teams: use a managed guardrail service and narrow scope. Large platforms: run classifiers per tenant policy, maintain an internal jailbreak test set, and feed abuse monitoring into the SOC.

Implementing defences in phases

Define the content policy. Write down what the application must never output or do, per audience. Classifiers need a policy to enforce.
Move authority out of the prompt. Remove secrets and permission logic from system prompts; enforce limits in code and tool permissions.
Add output filtering first. It catches harmful results however they were produced. Start in log-only mode to measure false positives.
Add input classification, including conversation context. Check the whole conversation and uploaded or retrieved content, not just the latest message.
Build a regression test set. Collect jailbreak families relevant to your use case from red teaming and public research, and run them against every model, prompt and guardrail change. See the AI Red Teaming Guide.
Turn on enforcement in rings. Internal users, then a share of traffic, then everyone; roll back by returning the classifier to log-only, never by removing logging.
Monitor and respond. Route blocked attempts and suspected successful jailbreaks to a review queue with clear ownership.

Detection and measurement

Log the right things: conversation ID, user or client identity, classifier verdicts and scores at input and output, tool calls proposed and blocked, and model and prompt versions.
Watch for patterns: repeated blocks from one user, sudden growth in context length, encoded or mixed-language input, long conversations with steadily rising classifier scores, and requests for the system prompt.
Treat agents as identities: attribute every tool call to the agent's identity and the human it acts for, so a jailbroken session can be traced and its credentials revoked.

Metrics: red team attack success rate per release (target trending down); classifier block rate on known jailbreak sets; false refusal rate on a benign evaluation set; blocked tool calls per thousand agent sessions; time from a new public jailbreak family to a regression test; repeat-offender accounts actioned.

Common failure patterns

Prompt-only defence: relying on "never do X" in the system prompt. It is the first thing a jailbreak targets.
Single-message checks: classifiers that look at the latest message miss multi-turn escalation of the Crescendo kind.
No output check: filtering inputs only, so any bypass reaches the user or the tool unchecked.
Authority in the model: letting the bot's text stand as a commitment, as the $1 car case illustrated, or letting an agent's reasoning decide what it is allowed to do.
Untested changes: a model upgrade, prompt edit or system update changes behaviour; DPD's incident followed a system update.
Over-blocking: classifiers so strict that legitimate users are refused and go to unmanaged tools instead. Measure false refusals.

Lessons from incidents

The public cases are small, but the pattern is consistent. The DPD chatbot misbehaved after a system update, which points to change control: every update to a model, prompt or guardrail needs the jailbreak regression set run before release. The Chevrolet dealer chatbot "agreed" to a $1 price because nothing outside the model limited what it could offer, which points to enforcing authority in application code. The Air Canada ruling involved no attacker at all, yet the tribunal rejected the argument that the chatbot was responsible for its own actions and held the airline liable for its answer. Together they show that an organisation owns what its model says and does, so output checks and authority limits are needed whether the trigger is a jailbreak, an injection or an ordinary mistake.

Where identity fits

Jailbreak impact scales with the identity behind the model. A chatbot with no tools can only produce text; an agent holding API keys, OAuth tokens or a service account can act. Give each agent its own identity rather than a shared key, scope its credentials to the tools it needs, keep them short-lived, and log every action against both the agent and the user it serves. When a jailbreak is suspected, you can then revoke one agent's access without disrupting everything else. See the Agent Identity and Access Guide.

Framework mapping

Framework	Reference	Relevance
OWASP Top 10 for LLM Applications 2025	LLM01 Prompt Injection; LLM07 System Prompt Leakage; LLM05 Improper Output Handling	Jailbreaking as a form of prompt injection; prompt disclosure; output checks
MITRE ATLAS	AML.T0054 LLM Jailbreak; AML.T0051 LLM Prompt Injection; AML.T0068 LLM Prompt Obfuscation	Technique tracking for threat modelling and detection
NIST AI 600-1	Information Security; Dangerous, Violent, or Hateful Content; CBRN Information or Capabilities	Generative AI risk categories affected by jailbreaks
NIST AI 100-2 E2025	Adversarial ML taxonomy	Terminology for attacks on generative AI and mitigations
NIST SP 800-53 Rev. 5	SI-4, SI-10, AC-6	Monitoring, input validation, least privilege for agents

Practitioner checklist

Write a content and action policy for each AI application.
Remove secrets and authorisation logic from system prompts.
Filter outputs before display, storage or action.
Classify inputs with conversation context, including files and retrieved content.
Gate every agent tool call against permissions, outside the model.
Maintain a jailbreak regression set covering each technique family.
Re-test after every model, prompt or guardrail change.
Log classifier verdicts and tool decisions with user and agent identity.
Track attack success, block and false refusal rates per release.

LLM Jailbreaks Guide: Technique families, detection and layered defences explained