jailbreak

A jailbreak is an adversarial prompt crafted to bypass the intended safety policies, role-instructions, or guardrails of a model system, such as a large language model, so that it produces disallowed or unintended behavior.

In practice, jailbreaks may take the form of carefully structured instructions, role-play scenarios, obfuscation or encoding tricks, or multi-step workflows that cause the system to misinterpret or override its internal constraints.

A jailbreak differs from a prompt injection in what the attack targets rather than in how it arrives. A jailbreak aims at the model’s own output restrictions, circumventing refusal behavior and safety training. A prompt injection exploits the concatenation of untrusted input with a prompt written by a higher-trust party, such as the application designer, so that the untrusted text is read as instructions.

Injections are further split in two. In direct prompt injection, the person at the interface supplies the instructions. In indirect prompt injection, a third party smuggles them in through untrusted content that the system ingests, such as a retrieved web page, document, or tool result.

The two categories overlap, since attacker-planted content can carry jailbreak framing, and the field’s most-cited LLM security taxonomy folds one into the other: OWASP’s LLM01:2025 Prompt Injection entry states that jailbreaking is a form of prompt injection in which the attacker’s inputs cause the model to disregard its safety protocols entirely.

Effective mitigation requires layered defense, and the useful layers differ by threat model. Against jailbreaks, the person prompting the model is the adversary. Defenses include screening user input, hardening the system prompt so that it states its boundaries and how to refuse, and enforcing a hierarchy in which lower-trust messages can’t override higher-trust policy.

They also include throttling accounts that repeatedly probe the guardrails, and red-teaming the application before deployment. Against instructions that arrive inside untrusted content, defenses include instruction isolation, provenance checks, allow and deny lists for tool invocation, and execution under least privilege. Continuous evaluation and monitoring apply to both.