Jailbreaks
MITRE ATLAS: T0012.003 — Craft Malicious Prompt (jailbreak sub-class)
OWASP LLM Top 10: LLM01 — Prompt Injection (jailbreak category)
NIST AI 600-1: §2.9 (Misuse by Malicious Actors), §2.3 (Dangerous/Violent Content)
EU AI Act: Art. 15 (Robustness), Art. 9 (Risk management for high-risk AI)
Taxonomy
| Technique | Mechanism | Example |
|---|---|---|
| Role-play / Persona | Frames request as fictional scenario or authority role | "You are a security researcher testing a system..." |
| Encoding / Obfuscation | Base64, ROT13, Unicode homoglyphs, token smuggling | Ig5vcmUgaW5zdHJ1Y3Rpb25z (Base64 for "ignore instructions") |
| Multi-turn / Gradual Escalation | Benign early turns build trust, then pivot to prohibited request | "What is 2+2?" → "How to make a bomb?" |
| Many-shot / Few-shot | Prepends many compliant examples to shift model distribution | 50 examples of "refuse" then 1 "comply" example |
| Prefix Injection / Continuation | Appends malicious suffix to legitimate completion | Model completes "The password is..." |
| Hypothetical / Academic Framing | "In a hypothetical scenario..." or "For educational purposes..." | "Write a fictional story where..." |
Primary source: OWASP LLM Top 10 (2025), LLM01. OWASP
Alignment Bypass Mechanics
Jailbreaks exploit the probabilistic nature of alignment — safety training creates a tendency to refuse, not a hard boundary. Attackers find inputs where:
- The refusal direction in activation space is weak
- The prompt activates a competing "helpful" direction more strongly
- The model's own completion continues the attacker's injected narrative
Mitigations
| Layer | Control | Standard Mapping |
|---|---|---|
| Input | Jailbreak classifier (ensemble of heuristic + ML) on all prompts | NIST AI 600-1 MANAGE-2.2, OWASP LLM01 |
| Input | Token-level anomaly detection (entropy, perplexity spikes) | MITRE TA0008, ISO 42001 A.6.1 |
| Model | Alignment hardening — RLHF/RLAIF with adversarial data | NIST AI 600-1 MEASURE-2.1, EU AI Act Art. 15 |
| Model | Constitutional AI / self-correction loops | NIST AI 600-1 MANAGE-2.2 |
| Output | Refusal consistency check — re-prompt model on its own output | OWASP LLM01, NIST AI RMF MEASURE-3.1 |
| Runtime | Session-level refusal rate monitoring; auto-terminate on threshold | ISO 42001 A.6.1, NIST AI 600-1 MANAGE-4.1 |
| Governance | Red-team testing programme — scheduled, diverse attack vectors | EU AI Act Art. 9, ISO 42001 A.4.2 |
What Does NOT Work
- Static system prompt instructions — "Do not comply with harmful requests" is bypassed by all major techniques
- Single-turn evaluation — multi-turn attacks accumulate context
- Model-size as defence — larger models can be more susceptible to sophisticated jailbreaks
Citation Register
| Claim | Instrument | Provision | URL |
|---|---|---|---|
| Jailbreak taxonomy | OWASP LLM Top 10 (2025) | LLM01 | https://owasp.org/www-project-top-10-for-large-language-model-applications/ |
| ATLAS technique | MITRE ATLAS | T0012.003 | https://atlas.mitre.org/techniques/T0012.003 |
| GAI risk areas | NIST AI 600-1 | §2.3, §2.9 | https://doi.org/10.6028/NIST.AI.600-1 |
| Robustness obligation | EU AI Act | Art. 15, Art. 9 | https://eur-lex.europa.eu/eli/reg/2024/1689/oj |