LLM Jailbreak Examples: 10 Documented Patterns

Search for LLM jailbreak examples and most of what comes back is a copy-pasted prompt list: stale, undated, and usually patched before it was posted. That format is close to useless for security work, because a string that worked against one checkpoint in one month says nothing about the class of weakness it exploited.

What follows is the other kind of catalog: ten jailbreak patterns that appear in peer-reviewed or vendor-published research, described at the level of mechanism rather than payload. Each entry states what the attack does to the model, what the source reported for effectiveness, and what a defender can look at to catch it. No working payloads appear here, and none are needed — the mechanism is the transferable part, and it is what survives the next patch cycle.

OWASP classifies jailbreaking as a subtype of LLM01 Prompt Injection, because both exploit the same structural fact: a model receives instructions and data in one undifferentiated token stream, and alignment training never fully teaches it which is which. The prompt injection versus jailbreak breakdown sets out where the line sits.

The ten patterns at a glance

#	Pattern	Access needed	Reported effectiveness	Primary detection signal
1	Persona hijacking (DAN-class)	Chat interface	Largely patched on frontier models; still lands on unaligned or older checkpoints	Role-assignment phrasing, refusal-suppression instructions
2	Multi-turn escalation (Crescendo)	Chat interface, several turns	Automated variant beat the prior best technique by 29–61% on GPT-4, 49–71% on Gemini-Pro (AdvBench subset)	Topic drift across turns, conversation-level scoring
3	Payload splitting	Chat interface, several turns	Varies by target; defeats per-message filtering by design	Cross-turn assembly requests, output-side review
4	Many-shot flooding	Long context window	Harmful-response rates climb with shot count into the hundreds	Very long homogeneous Q/A blocks in user content
5	Cross-lingual (low-resource)	Chat interface	79% on AdvBench when translating into low-resource languages	Language ID mismatch with expected traffic
6	Encoding and obfuscation	Chat interface	Depends on the model’s decoding fluency	Base64, hex, ASCII art, character-substitution density
7	Random-augmentation search (Best-of-N)	API, high query volume	89% on GPT-4o and over 50% on all eight models tested, at 10,000 sampled variants	Repeated near-duplicate prompts from one identity
8	Gradient-optimized suffixes (GCG)	White-box surrogate, then transfer	High on the surrogate, meaningful transfer to hosted models	High perplexity token runs
9	Stealthy prompt optimization (AutoDAN)	White-box or strong surrogate	Comparable success to GCG with fluent, low-perplexity text	Semantic classifiers, not perplexity
10	Multimodal and visual injection	Image or document upload	Effective wherever the vision encoder is inside the trust boundary	OCR plus text scanning of uploaded media

1. Persona hijacking

The attacker instructs the model to adopt an alternate identity defined as having no restrictions, then routes the real request through that identity. The “Do Anything Now” family is the archetype and has gone through dozens of numbered revisions as vendors patched individual phrasings. Shen et al. collected 1,405 in-the-wild jailbreak prompts posted between December 2022 and December 2023 and analysed the attack strategies behind them, which is the closest thing to a census of how this family actually circulates.

The mechanism is an objective conflict. A model is trained to be helpful, to follow instructions, and to roleplay convincingly. It is separately trained to refuse certain categories. Persona framing pits the first three against the fourth and sometimes wins. Later variants ask the model to narrate a character rather than become one, moving the request one level further from the refusal trigger.

Frontier models are now well patched against the published variants. The pattern still matters for two reasons: self-hosted and fine-tuned models frequently ship without that patching, and persona framing is a cheap wrapper that combines with every other technique on this list.

2. Multi-turn escalation

Crescendo, documented by Microsoft researchers, starts with a completely benign question about a topic and escalates gradually, each turn referencing the model’s own previous answer. Because the model treats its own prior output as trusted context, it is progressively drawn into a position it would have refused from a standing start.

The source paper reports high attack success rates across every model and task it evaluated — ChatGPT, Gemini Pro, Gemini Ultra, Llama-2 70B Chat, Llama-3 70B Chat and Anthropic Chat. Its automated variant, Crescendomation, beat the next-best jailbreaking technique on the AdvBench subset by 29–61% on GPT-4 and by 49–71% on Gemini-Pro.

The defensive implication is specific and frequently missed: a filter that scores each user message in isolation cannot see this attack. Every individual turn is benign. Detection has to run at conversation level, watching for the trajectory rather than the message.

3. Payload splitting

Closely related, but structurally different. Instead of escalating the topic, the attacker decomposes a single prohibited request into fragments that each pass evaluation, then asks the model to combine what it has already produced. The synthesis step is where the policy violation is created, and by then all of the ingredients are inside the context as the model’s own trusted output.

This is the pattern that most reliably breaks input-only guardrails, and it is why output-side filtering is not optional. It is also disproportionately effective in agent frameworks, where context accumulates across tool calls and intermediate results without any per-step policy check. The mechanics of that accumulation are covered in the context window poisoning walkthrough.

4. Many-shot flooding

Anthropic’s April 2024 research documented that prepending hundreds of synthetic question-and-answer pairs — a fake transcript of an assistant complying with escalating requests — pushes the model into continuing the pattern. Harmful response rates rise sharply as the shot count grows, and the effect scales with context length rather than with prompt cleverness.

This is the attack that gets structurally worse as the industry ships longer context windows. A 200K-token window is a 200K-token demonstration budget. The full mechanism, the reported curve, and why mitigation forces a capability trade-off are covered in the dedicated write-up on many-shot jailbreaking.

Detection here is unusually tractable compared with the rest of this list. A user message containing hundreds of uniformly formatted Q/A pairs is a strong signal in almost any production traffic profile.

5. Cross-lingual attacks

Safety training coverage follows training-data volume, which means it is thin in low-resource languages. Yong, Menghini and Bach showed that translating unsafe English prompts into low-resource languages, submitting them to GPT-4, and translating the responses back yielded actionable harmful output 79% of the time on AdvBench, which the authors describe as on par with or better than the state-of-the-art jailbreaking attacks of that period. High- and mid-resource languages showed significantly lower success rates, which localises the weakness precisely.

The attack needs no specialised tooling, only a public translation API. It is also awkward to patch, because the fix is either language-aware guardrails at the input layer or safety training in languages with little available data.

6. Encoding and obfuscation

The request is transformed so that the safety classifier sees something different from what the model ultimately processes: Base64, hexadecimal, ROT-style substitution, character-level noise, or ASCII art rendering of a trigger word. Capable models decode the payload; shallow pattern-matching filters do not.

Effectiveness tracks the gap between the model’s decoding ability and the filter’s. As models get more fluent at recovering mangled text, this class gets stronger rather than weaker, which is an uncomfortable property for a defence strategy built on input matching.

7. Random-augmentation search

Best-of-N jailbreaking is the least sophisticated technique on this list and one of the most effective. The algorithm repeatedly samples augmented variants of the same prompt — shuffled characters, changed capitalisation, injected noise — until one gets through. The published results report an 89% attack success rate on GPT-4o and 78% on Claude 3.5 Sonnet at 10,000 sampled variants, and over 50% on all eight models tested at that budget.

Two findings matter more than the headline numbers. Success as a function of sample count follows power-law-like behaviour over many orders of magnitude, which turns jailbreak success into a budget question rather than a skill question. And the technique remained effective against a state-of-the-art open-source defense, reaching 52% against circuit breakers — the defense raised the price of the attack rather than preventing it.

That makes rate limiting and per-identity anomaly detection load-bearing security controls, not hygiene. Raising attacker cost is worth very little if one identity can issue ten thousand near-duplicate prompts unchallenged.

8. Gradient-optimized suffixes

The GCG attack from Zou et al. appends an algorithmically optimized token sequence to a harmful request. The suffix is gibberish to a reader but steers the model’s internal activations toward compliance. The important property is transfer: suffixes optimized against open-weight models frequently work against hosted models the attacker never had gradients for.

That transfer property is what makes this a supply-chain concern rather than a per-model one. An open-weight release that shares lineage with a hosted product hands attackers a free surrogate. The GCG practitioner guide covers the optimization loop, the compute cost, and the reasons transfer rates vary between model families.

Perplexity filtering catches classic GCG suffixes reliably, because the token runs are statistically bizarre. Which leads directly to the next entry.

9. Stealthy prompt optimization

AutoDAN and related work responded to perplexity filtering by optimizing for fluent, human-readable jailbreak prompts instead of token noise, using genetic search over semantically coherent candidates. The resulting prompts read like ordinary English, so the defence that neutralizes GCG does nothing.

That pair is the cleanest illustration of why single-signal defences age badly: perplexity filtering answered a specific attack for a specific window, and the counter cost the research community one paper.

10. Multimodal and visual injection

When the model accepts images, the instruction can live in the image: rendered text a vision encoder reads, adversarially perturbed pixels, or instructions embedded in a document that a pipeline OCRs before summarising. The text-side guardrail never sees the payload because the payload is not text when it arrives.

This is the fastest-growing surface on the list, because document ingestion, screenshot analysis, and browsing agents all put the vision encoder inside the trust boundary. The visual prompt injection write-up covers the specific delivery paths and what a scanning layer needs to cover.

Reading the success rates honestly

Attack success rate is the standard metric across this literature, and it is not standardised. The Bag of Tricks benchmark evaluated eight separate factors that shift measured jailbreak effectiveness — target model, system prompt, judge model, evaluation set and attack budget among them — and found reported numbers move substantially with choices that papers often do not foreground.

Three practical consequences:

• ASR values from different papers are not comparable. A 90% figure judged by a permissive keyword matcher and a 60% figure judged by a strict model grader may describe the same underlying capability.
• System prompt presence changes results significantly. Evaluating a bare model overstates what an attacker faces against a hardened deployment; evaluating a hardened one understates the risk of an exposed endpoint.
• Query budget is a free variable. Best-of-N demonstrates that success is buyable. Any ASR quoted without the budget attached is incomplete.

Turning the list into a test plan

A catalog is only useful if it maps to your architecture. Most of these ten do not apply to any given system: cross-lingual attacks matter little behind a language-gated edge, visual injection is irrelevant without an image path, and transfer attacks need a plausible open-weight surrogate.

The Red Team Plan Builder on this site does that mapping mechanically. Selecting the components a target actually has and the trust boundaries an attacker can actually reach returns an ordered checklist covering only the techniques those choices make reachable, with the prerequisite and success indicator for each. It is a scoping aid for authorized testing, not a payload library.

Once the plan exists, the detection side is the other half of the work. The four detection approaches ranked covers what each signal class can and cannot see, and the companion analysis of jailbreak defenses covers what happens to those defenses when the attacker is allowed to adapt to them. For the broader taxonomy of technique families beyond this ten, the jailbreak techniques overview is the wider map, and jailbreaks.fyi tracks dated technique reports as they are disclosed.