Jailbreak

A refusal is a tendency, not a lock

When an AI turns down a request, nothing clicks shut inside it. It learned, from an enormous number of examples, what to help with and what to decline, and that became a tendency to lean toward refusal in similar situations. A tendency is a probability, so it shifts when the surrounding context shifts.

Which means the same request can land differently depending on what story it's embedded in. The framing set up beforehand, the tone, how long the conversation has run, all of these nudge that lean a little. The rule hasn't disappeared. Its weight, in that particular context, has just gotten lighter.

Same as the revolving door. The door was never locked, it's just built so one direction turns more easily, and when the direction of the push changes, the door follows.

Aim at the yardstick and a workaround opens up

The arrows on the floor aren't the real standard. The real standard is that people pass through safely without colliding, and the arrows are a stand-in put there to communicate that quickly. But once a stand-in is in use, a path opens up that only has to slip past that stand-in.

An AI's safety measures work the same way. The real standard is whether an answer actually causes harm, but what the model is actually holding onto is the surface pattern of a request that looks risky. Change just the surface pattern, and the same request can start looking like a different one.

As long as there's a gap between the stand-in and the actual goal, workarounds aimed at the stand-in keep appearing. Which is why, every time a new workaround turns up, that case gets folded back into training to sharpen the stand-in, over and over.

Three patterns that show up often

The first reframes the situation. Wrapping a request in role-play, a fictional scenario, or a research-or-education framing to recast the moment as "this isn't the usual situation." It leans on the part of training that taught the model rules can shift depending on context.

The second splits things apart. Something that would get declined if asked all at once gets asked in pieces instead. Each individual piece looks ordinary enough that there's little for a refusal to grab onto at any single step.

The third changes the format. Wrapping something in a different language, an unfamiliar notation, or a table or list format blurs the sense of how risky it is. The further the surface form drifts from the examples used in safety training, the weaker that tendency gets.

Easy to confuse with injection

The two terms get used together often enough that they blur into one, but pulled apart they're simple. A jailbreak is the person sitting at the conversation pushing the door backward themselves. Prompt injection is when that person did nothing wrong at all, and a document or webpage the AI read in pushes an instruction in on its own.

Where responsibility sits differs too. A jailbreak is closer to a question of how far a service decides to allow things to go. Injection is closer to a design question of what material and what permissions an AI gets handed in the first place. The defenses split the same way: the first is met with safety training and request checks, the second with narrower permissions and how source material gets handled.

Defenses come in layers

No one relies on the model alone. A separate check on what comes in, another check on what goes out, policy text the model consults while answering, and a decision to strip a risky capability out of the service entirely, all of these get used together. It's the same idea as fitting a revolving door with a latch against turning backward, limiting how fast it spins, and, failing that, closing the passage off entirely. If one layer leaks, the next layer is there to catch it.

Tighten it too far and the opposite problem shows up. Refuse safety-related questions or fiction along with everything else and the service loses a lot of its usefulness. How tight to set that dial isn't really a technical choice. It's a decision about who a service is for and what it's trying to do.