An AI jailbreak is any input that gets a language model to bypass its safety training and produce content it was built to refuse. Jailbreaking overlaps with prompt injection but the goal is different: prompt injection hijacks an application's instructions, while a jailbreak targets the model's own guardrails. This guide walks through the main families of jailbreak techniques, explains why each one works, and shows how to defend. Every technique here maps to a hands-on entry in the prompt injection cheat sheet.
Why jailbreaks work at all
Safety in a language model is learned behavior, not an enforced rule. The model was trained to decline certain requests, but that refusal is a statistical tendency, not a hard authorization boundary. A jailbreak looks for a framing where the model's helpfulness training outweighs its refusal training. That is why the same request, phrased differently, can flip from refused to answered. Understanding that tension is the key to both attacking and defending.
Roleplay and persona jailbreaks (DAN and friends)
The best known family asks the model to play a character that has no restrictions. The classic example is DAN, short for "Do Anything Now," a persona the user defines as an AI free of the usual rules. Variations tell the model it is a fictional character, an unfiltered research assistant, or a system in "developer mode."
These work because the model treats the request as a creative writing task rather than a policy question. By wrapping the harmful ask inside a story or a character, the attacker shifts the model into a mode where refusing feels like breaking character. Modern models resist the plain DAN prompt, so real attempts layer it with other techniques below.
Fake authority and framing
This family manipulates the context the model reasons about. Common patterns include claiming to be a developer or safety researcher who needs the restricted content for testing, asserting that a policy changed, or framing the harmful request as necessary to prevent a greater harm. Another variant inserts fake system messages such as text that looks like a new set of developer instructions.
Framing attacks succeed when the model cannot verify the claim. It has no way to confirm you are really a safety tester, so a confident, well structured claim can tilt its response. Instruction hierarchy training reduces this, but does not remove it.
Encoding and obfuscation
Instead of persuading the model, this family hides the request from the filters that guard it. The harmful words are encoded (Base64, hex, ROT13), disguised with look-alike characters (homoglyphs), or hidden with zero-width characters. A keyword or classifier filter scanning the input sees gibberish, while the model still decodes and acts on the content.
You can reproduce every one of these encodings in Reveal Trace, our free encode and decode tool, and see exactly what the model receives versus what a naive filter sees. This is the single most transferable jailbreak family, because it attacks the defense rather than the model.
Multi-turn and crescendo attacks
Rather than asking for the restricted content directly, a multi-turn attack builds up to it across several messages. Each turn is individually harmless, so no single message trips a filter, but together they walk the model to the target. The crescendo pattern starts with a benign version of the topic and escalates gradually, using the model's own prior answers as justification for the next step.
These attacks are effective because most safety checks evaluate one message at a time. Defending against them requires reasoning over the whole conversation, which is harder and more expensive.
Reasoning and instruction exploits
This family targets how the model thinks. Techniques include asking the model to reason step by step until it talks itself past a rule, splitting a banned word across tokens so filters miss it, overloading the model with complex nested instructions so safety checks get dropped, or exploiting the boundary between the system prompt and user input with special delimiters. On the cheat sheet these appear under the reasoning and overriding categories.
How to defend against jailbreaks
No single control stops every jailbreak, so defense is layered. Practical measures include a strong instruction hierarchy so developer messages outrank user content, input and output classifiers that normalize and decode text before scanning, limiting the tools and data the model can reach so a successful jailbreak has less to abuse, and evaluating the full conversation rather than single turns. The LLM defenses module covers why each defense helps and where it fails.
Practice on real models
Reading about jailbreaks is not the same as running them. In PromptTrace's free labs you attempt these techniques against real language models and watch the Context Trace show why each attempt works or fails. When you are ready for a challenge, the Gauntlet ramps up the defenses level by level. Start with the cheat sheet for the full catalog of techniques and payloads.