LLM Jailbreak Techniques Cheat Sheet: Families & Defenses
A jailbreak is any input that gets a model to do what its safety training says it shouldn't. New ones appear weekly, but they fall into a handful of families — and knowing the families is how a red-teamer covers ground and a defender recognises an attack in the logs. This is the map, plus the defenses that actually move the needle.
For defense and authorized red-teaming only. This is a taxonomy, not a payload dump: it describes how attack classes work so you can test your own models and build defenses. Using these to pull harmful content out of a live system is an abuse of it, not research — and it's exactly what the defenses below exist to stop.
Jailbreak vs prompt injection
They overlap, but the target differs. Prompt injection overrides the application's instructions — “ignore your system prompt and do this.” A jailbreak targets the model's own safety alignment — the training that makes it refuse certain content regardless of the app. In practice attackers chain both: inject to seize control, jailbreak to remove the guardrails.
The technique families
Most real jailbreaks are combinations of these. Recognise the shape and you can write a detection or a test for it.
| Family | How it works |
|---|---|
| Persona / role-play | Ask the model to become a character with no rules (the “DAN” family). Refusing is framed as breaking character rather than breaking policy. |
| Hypothetical framing | Wrap the request in fiction, a screenplay, a “for a novel” or “in a world where…” so the harmful content reads as make-believe. |
| Refusal suppression | Instruct the model up front to never apologise or say “I can't”, steering it past the phrasing its safety training keys on. |
| Payload splitting | Break a blocked request into innocuous fragments the model assembles itself, so no single message trips a filter. |
| Obfuscation & encoding | Hide the intent in Base64, leetspeak, unusual Unicode, or another language, betting the safety layer reads it less carefully than the model does. |
| Many-shot | Fill a long context with dozens of fake examples of the model complying, so the next answer follows the established pattern. |
| Crescendo (multi-turn) | Start benign and escalate over several turns, each a small step, until the model is somewhere it would have refused in one shot. |
| Prompt leak then reuse | Extract the system prompt first (see LLM08), then craft an attack tuned to the exact rules it revealed. |
Why they work at all
Safety alignment is statistical, not a hard rule. The model learned to refuse patterns it saw in training; anything that shifts far enough from those patterns — a new framing, a long context, another language — can slip through. There's also a built-in tension: the same model is trained to be maximally helpful and to refuse, and a clever prompt pits one objective against the other. That's why there is no permanent fix, only a moving defense.
Defenses that actually help
No single control stops jailbreaks. Layer these and you raise the cost past what most attackers will pay.
- Independent input/output classifiers. A separate guard model that scores prompts and responses catches what the main model rationalises past — and isn't itself steered by the same prompt.
- Don't depend on the system prompt. “Never do X” in the prompt is a speed bump, not a wall. Enforce hard limits in code and tooling the model can't talk around.
- Constrain the blast radius. If a jailbreak only yields text, it's a content problem; if the model can act, it's an incident. Keep tools least-privilege (see LLM03).
- Monitor and rate-limit. Jailbreaks are iterative — attackers probe repeatedly. Per-user rate limits and anomaly alerts turn a quiet grind into a visible one.
- Red-team continuously. Because new families keep appearing, one-time testing ages out fast. Automate a suite of the families above and re-run it on every model or prompt change.
- Treat multi-turn as one surface. Crescendo attacks hide in conversation history — evaluate the whole session, not just the latest message.
Go deeper
- Prompt injection cheat sheet — the sibling technique jailbreaks are usually chained with.
- LLM security lab — a local range to try these safely on a target that's meant to be broken.
- OWASP LLM Top 10 — where jailbreaks sit in the wider risk map.
- MITRE ATLAS — the adversarial-ML knowledge base, for the formal technique catalogue.
A plain-language taxonomy of publicly documented jailbreak classes, framed for defense; deliberately no working payloads. Aligned to OWASP LLM01:2026. New family you're seeing that isn't here? Tell me and I'll add it.