LLM Jailbreak Cheat Sheet
A quick-reference of common LLM jailbreak techniques with one-line how-it-works and one-line defense for each, for authorized red-team use.
This is a fast lookup for the jailbreak families that AI red-teamers run against chat models. A jailbreak tries to make a model ignore its own safety policy through framing, role assignment, or output manipulation — distinct from prompt injection, which hijacks instructions through untrusted data. The two overlap and are often chained.
Important caveat: every technique below is model- and version-specific and decays. A payload that worked on one release is frequently patched in the next. Treat this table as a starting taxonomy for your own test harness, not a list of guaranteed bypasses. See OWASP LLM01: Prompt Injection (https://genai.owasp.org/llmrisk/llm01-prompt-injection/).
Authorized use only: run these against systems you own or are explicitly contracted to test.
Technique quick reference
| Technique | How it works (one line) | Defense (one line) |
|---|---|---|
| Persona / DAN ("Do Anything Now") | Assign an alter-ego that "has no rules" so the model speaks as the unrestricted character. | Anchor identity and policy in the system prompt; train the model to reject role reassignment that overrides safety. |
| AIM (Always Intelligent and Machiavellian) | A fictional amoral advisor persona is asked to answer "without ethics or refusals." | Same as persona defenses; classify requests for explicitly unethical/no-refusal personas and refuse them. |
| Developer / debug mode | Claim a hidden maintenance mode exists that disables filters for "testing." | Reject claims of privileged modes from user input; modes must come from authenticated, server-side configuration only. |
| Hypothetical / fiction framing | Wrap the disallowed request in a story, screenplay, or "purely hypothetical" scenario. | Apply policy to the content of the output, not the wrapper; classify on intent, not the fictional frame. |
| Grandma exploit | Emotional roleplay ("my late grandma used to read me...") to coax restricted content as comfort. | Detect emotionally framed pretexts; evaluate the requested payload independently of the sympathetic story. |
| Prefix injection | Force the reply to begin with a compliant opener ("Sure, here is...") so it continues down that path. | Output-side classification on full responses; do not let a forced prefix short-circuit refusal logic. |
| Refusal suppression | Instruct the model to never apologize, never say "I can't," and avoid refusal vocabulary. | Make refusal a hard policy outcome, not a stylistic choice the prompt can disable. |
| Many-shot jailbreaking | Stuff the context with dozens/hundreds of fake Q&A pairs where the assistant always complies, then ask the real question. | Limit/scan long in-context example blocks; safety tuning robust to many-shot; monitor context for compliance-priming patterns. |
| Crescendo | Start benign and escalate over several turns, each step a small increment toward the disallowed goal. | Evaluate conversation-level trajectory, not just the latest turn; reset risk scoring across the dialogue. |
| Payload splitting | Break the disallowed instruction across variables/turns and have the model concatenate and execute it. | Reassemble and re-evaluate combined content before acting; classify the assembled result, not the fragments. |
Why these keep working (briefly)
Most jailbreaks exploit the same root cause: the model treats the entire prompt as a single instruction space, with no hard boundary between "policy" and "user-supplied roleplay." Persona, fiction, and mode-claim attacks all try to relocate the request into a context where the model believes the rules do not apply. Prefix and refusal-suppression attacks instead attack the output shape, betting that once the model starts complying it will continue. Many-shot and crescendo are statistical: they bias the model with overwhelming in-context precedent or gradual normalization.
Defenses (layered)
No single control stops jailbreaks. Combine:
- System-prompt hardening — state non-negotiable policy, refuse role/mode reassignment, and place safety instructions where user text cannot overwrite them.
- Input and output classification — screen prompts and full responses with a separate safety model; classify on intent and content, ignoring fictional or emotional wrappers.
- Conversation-level monitoring — score the whole dialogue to catch crescendo and multi-turn payload assembly, not just the current message.
- Context hygiene — cap and inspect long example blocks to blunt many-shot priming.
- Continuous red-teaming — because techniques decay and mutate, re-run an automated suite against every model/prompt change and track regression.
How to test it safely
Keep a versioned harness of these payloads mapped to expected-refusal cases. Run it on each model upgrade or system-prompt change, record pass/fail per technique, and treat any new pass as a regression to fix. Only test systems you are authorized to assess, and avoid generating genuinely harmful artifacts — use canary/benign proxies where possible to confirm a bypass without producing real harm.