📚 Series: AI Red Teaming — Chapter 3

🏷️ Tags: Jailbreaking Context Reframing Competing Objectives Many-Shot Skeleton Key

⏱️ Level: Intermediate

✅ Prereq: Chapter 2

Injection failed on you? Good — that means the model's actually trained. This is where it gets fun. Jailbreaking isn't about fighting the rules, it's about making your request not look like the thing the rules were trained to catch. Same meaning, different clothes. 🎭

📌 In this one

• What a jailbreak actually is (vs "control hijacking")
• Why safety training can be walked around — the two failure modes worth memorizing
• Context reframing — the methods I rotate through
• Real families: DAN, Grandma, Crescendo, Many-Shot, Skeleton Key
• Lab + an exploitation playbook

1️⃣ Jailbreak vs control hijacking

A jailbreak = you get the model to output something it was trained/intended to refuse. If you just make it behave weirdly (say "BANANA" to everything) without leaking anything protected, that's control hijacking — manipulated, but not jailbroken. Worth keeping straight in a report; they're different severities.

2️⃣ 🔬 Why this works (the part that made me good at it)

Safety isn't if bad: refuse(). During RLHF the model is rewarded for refusing unsafe-looking requests. So a refusal is a high-probability pattern that fires when your input matches the shape it was trained on. Two ways to dodge it (Wei et al., "Jailbroken"):

• Competing objectives — it's trained to be helpful and harmless. Set those against each other (make refusing feel unhelpful/unkind) and helpfulness can win. Every emotional/roleplay jailbreak lives here.
• Mismatched generalization — safety training didn't cover every input the base model still understands. Base64, low-resource languages, weird formats fall outside the safety distribution but inside the capability distribution. That's why Ch 6 encoding works.