LLM Jailbreak Examples: 10 Documented Patterns

An LLM jailbreak is an input that makes a large language model produce output its safety training is meant to refuse. Published research documents ten recurring patterns: persona hijacking, multi-turn escalation, payload splitting, many-shot flooding, cross-lingual prompts, encoding, Best-of-N search, gradient-optimized suffixes, fluent optimized prompts and visual injection.

Most jailbreak prompt lists are copy-pasted strings, undated and usually patched before they were posted, and a string that beat one checkpoint in one month says nothing about the weakness it exploited. Each pattern below is described by mechanism instead: what it does to the model, what the source reported for effectiveness, and what a defender can watch for. No working payloads appear here; the mechanism is the part that survives the next patch cycle.

OWASP classifies jailbreaking as a subtype of LLM01 Prompt Injection, because both exploit the same structural fact: a model receives instructions and data in one undifferentiated token stream, and alignment training never fully teaches it which is which. The prompt injection versus jailbreak breakdown sets out where the line sits.

What is an LLM jailbreak, and why does it work?

An LLM jailbreak works because safety training is a learned preference layered on a capable model, not a hard rule. Wei, Haghtalab and Steinhardt named two failure modes behind it: competing objectives, where helpfulness and instruction-following outweigh refusal, and mismatched generalization, where the model can read inputs that safety training never covered.

Persona, multi-turn and many-shot attacks exploit the first; encoding, cross-lingual and visual attacks exploit the second. A “jailbreak prompt” usually means a hand-written one, but that is only one of four ways a jailbreak gets produced:

The hand-written family, including prefix injection and stacked combinations, gets closer treatment in the seven prompt jailbreak examples.

The ten patterns at a glance

1. Persona hijacking

The attacker instructs the model to adopt an alternate identity defined as having no restrictions, then routes the real request through that identity. The “Do Anything Now” family is the archetype and has gone through dozens of numbered revisions as vendors patched individual phrasings. Shen et al. collected 1,405 in-the-wild jailbreak prompts posted between December 2022 and December 2023 and analysed the attack strategies behind them, which is the closest thing to a census of how this family actually circulates.

The mechanism is an objective conflict. A model is trained to be helpful, to follow instructions, and to roleplay convincingly. It is separately trained to refuse certain categories. Persona framing pits the first three against the fourth and sometimes wins. Later variants ask the model to narrate a character rather than become one, moving the request one level further from the refusal trigger.

Frontier models are now well patched against the published variants. The pattern still matters for two reasons: self-hosted and fine-tuned models frequently ship without that patching, and persona framing is a cheap wrapper that combines with every other technique on this list.

2. Multi-turn escalation

Crescendo, documented by Microsoft researchers, starts with a completely benign question about a topic and escalates gradually, each turn referencing the model’s own previous answer. Because the model treats its own prior output as trusted context, it is progressively drawn into a position it would have refused from a standing start.

The source paper reports high attack success rates across every model and task it evaluated — ChatGPT, Gemini Pro, Gemini Ultra, Llama-2 70B Chat, Llama-3 70B Chat and Anthropic Chat. Its automated variant, Crescendomation, beat the next-best jailbreaking technique on the AdvBench subset by 29–61% on GPT-4 and by 49–71% on Gemini-Pro.

The defensive implication is specific and frequently missed: a filter that scores each user message in isolation cannot see this attack. Every individual turn is benign. Detection has to run at conversation level, watching for the trajectory rather than the message.

3. Payload splitting

Closely related, but structurally different. Instead of escalating the topic, the attacker decomposes a single prohibited request into fragments that each pass evaluation, then asks the model to combine what it has already produced. The synthesis step is where the policy violation is created, and by then all of the ingredients are inside the context as the model’s own trusted output.

This is the pattern that most reliably breaks input-only guardrails, and it is why output-side filtering is not optional. It is also disproportionately effective in agent frameworks, where context accumulates across tool calls and intermediate results without any per-step policy check. The mechanics of that accumulation are covered in the context window poisoning walkthrough.

4. Many-shot flooding

Anthropic’s April 2024 research documented that prepending hundreds of synthetic question-and-answer pairs — a fake transcript of an assistant complying with escalating requests — pushes the model into continuing the pattern. Harmful response rates rise sharply as the shot count grows, and the effect scales with context length rather than with prompt cleverness.

This is the attack that gets structurally worse as the industry ships longer context windows. A 200K-token window is a 200K-token demonstration budget. The full mechanism, the reported curve, and why mitigation forces a capability trade-off are covered in the dedicated write-up on many-shot jailbreaking.

Detection here is unusually tractable compared with the rest of this list. A user message containing hundreds of uniformly formatted Q/A pairs is a strong signal in almost any production traffic profile.

5. Cross-lingual attacks

Safety training coverage follows training-data volume, which means it is thin in low-resource languages. Yong, Menghini and Bach showed that translating unsafe English prompts into low-resource languages, submitting them to GPT-4, and translating the responses back yielded actionable harmful output 79% of the time on AdvBench, which the authors describe as on par with or better than the state-of-the-art jailbreaking attacks of that period. High- and mid-resource languages showed significantly lower success rates, which localises the weakness precisely.

The attack needs no specialised tooling, only a public translation API. It is also awkward to patch, because the fix is either language-aware guardrails at the input layer or safety training in languages with little available data.

6. Encoding and obfuscation

The request is transformed so that the safety classifier sees something different from what the model ultimately processes: Base64, hexadecimal, ROT-style substitution, character-level noise, or ASCII art rendering of a trigger word. Capable models decode the payload; shallow pattern-matching filters do not.

Effectiveness tracks the gap between the model’s decoding ability and the filter’s. As models get more fluent at recovering mangled text, this class gets stronger rather than weaker, which is an uncomfortable property for a defence strategy built on input matching.

7. Random-augmentation search

Best-of-N jailbreaking is the least sophisticated technique on this list and one of the most effective. The algorithm repeatedly samples augmented variants of the same prompt — shuffled characters, changed capitalisation, injected noise — until one gets through. The published results report an 89% attack success rate on GPT-4o and 78% on Claude 3.5 Sonnet at 10,000 sampled variants, and over 50% on all eight models tested at that budget.

Two findings matter more than the headline numbers. Success as a function of sample count follows power-law-like behaviour over many orders of magnitude, which turns jailbreak success into a budget question rather than a skill question. And the technique remained effective against a state-of-the-art open-source defense, reaching 52% against circuit breakers — the defense raised the price of the attack rather than preventing it.

That makes rate limiting and per-identity anomaly detection load-bearing security controls, not hygiene. Raising attacker cost is worth very little if one identity can issue ten thousand near-duplicate prompts unchallenged.

8. Gradient-optimized suffixes

The GCG attack from Zou et al. appends an algorithmically optimized token sequence to a harmful request. The suffix is gibberish to a reader but steers the model’s internal activations toward compliance. The important property is transfer: suffixes optimized against open-weight models frequently work against hosted models the attacker never had gradients for.

That transfer property is what makes this a supply-chain concern rather than a per-model one. An open-weight release that shares lineage with a hosted product hands attackers a free surrogate. The GCG practitioner guide covers the optimization loop, the compute cost, and the reasons transfer rates vary between model families.

Perplexity filtering catches classic GCG suffixes reliably, because the token runs are statistically bizarre. Which leads directly to the next entry.

9. Stealthy prompt optimization

AutoDAN and related work responded to perplexity filtering by optimizing for fluent, human-readable jailbreak prompts instead of token noise, using genetic search over semantically coherent candidates. The resulting prompts read like ordinary English, so the defence that neutralizes GCG does nothing.

That pair is the cleanest illustration of why single-signal defences age badly: perplexity filtering answered a specific attack for a specific window, and the counter cost the research community one paper.

10. Multimodal and visual injection

When the model accepts images, the instruction can live in the image: rendered text a vision encoder reads, adversarially perturbed pixels, or instructions embedded in a document that a pipeline OCRs before summarising. The text-side guardrail never sees the payload because the payload is not text when it arrives.

This is the fastest-growing surface on the list, because document ingestion, screenshot analysis, and browsing agents all put the vision encoder inside the trust boundary. The visual prompt injection write-up covers the specific delivery paths and what a scanning layer needs to cover.

Do LLM jailbreak prompts still work against current defenses?

Specific published jailbreak prompts are usually patched on frontier models, but the patterns behind them keep working, and the strongest defenses shrink the gap rather than close it. Anthropic’s Constitutional Classifiers cut jailbreak success in an automated evaluation from 86% to 4.4%, and a public demo still produced a universal jailbreak.

Per Anthropic’s write-up (February 2025), that evaluation used 10,000 synthetic jailbreak prompts. A two-month bug bounty (183 active participants, more than 3,000 hours) found no universal jailbreak against the prototype; the February 3 to 10 public demo then produced one, plus a borderline second. The defense cost 23.7% extra compute.

That is progress, not immunity. Self-hosted and fine-tuned checkpoints usually ship with no such layer, so persona and encoding prompts patched on hosted models still land there.

Reading the success rates honestly

Attack success rate is the standard metric across this literature, and it is not standardised. The Bag of Tricks benchmark evaluated eight separate factors that shift measured jailbreak effectiveness (model size, safety alignment, safety system prompt, chat template, attacker capability, attack budget, suffix length and attack intention) and found reported numbers move substantially with choices that papers often do not foreground. How success is judged is a further variable on top of those eight.

Three practical consequences:

• ASR values from different papers are not comparable. A 90% figure judged by a permissive keyword matcher and a 60% figure judged by a strict model grader may describe the same underlying capability.
• System prompt presence changes results significantly. Evaluating a bare model overstates what an attacker faces against a hardened deployment; evaluating a hardened one understates the risk of an exposed endpoint.
• Query budget is a free variable. Best-of-N demonstrates that success is buyable. Any ASR quoted without the budget attached is incomplete.

Two shared benchmarks narrow the gap: JailbreakBench fixes 100 behaviors, system prompts, chat templates and scoring functions behind a public leaderboard, and HarmBench compared 18 red-teaming methods across 33 target LLMs and defenses in one pipeline.

Turning the list into a test plan

A catalog is only useful if it maps to your architecture. Most of these ten do not apply to any given system: cross-lingual attacks matter little behind a language-gated edge, visual injection is irrelevant without an image path, and transfer attacks need a plausible open-weight surrogate.

The Red Team Plan Builder on this site does that mapping mechanically. Selecting the components a target actually has and the trust boundaries an attacker can actually reach returns an ordered checklist covering only the techniques those choices make reachable, with the prerequisite and success indicator for each. It is a scoping aid for authorized testing, not a payload library.

For an authorized test of your own deployment, open-source tooling covers most of the list (versions checked October 2026):

1. Scope first. Keep only the patterns your architecture exposes.
2. Run single-turn probes with garak. garak 0.17.0 (September 9, 2026, Python 3.11+) installs with python -m pip install -U garak. Its dan, encoding and gcg probe families map to patterns 1, 6 and 8. The project’s example is python3 -m garak --target_type huggingface --target_name gpt2 --spec probes.dan.Dan_11_0; point it at your own endpoint.
3. Run multi-turn attacks with PyRIT. Single-turn scanners cannot reach pattern 2. PyRIT 1.1.0 (September 4, 2026, pip install pyrit) runs Crescendo, TAP and Skeleton Key. Its Crescendo attack has an adversarial LLM write each turn and backtracks on refusal; the documented example sets max_turns=7 and max_backtracks=4.
4. Record budget, system prompt and judge with every result, or a re-run cannot tell you whether a fix worked.
5. Make every finding a regression test. The CI gate for prompt injection regression shows how to run them on every model or prompt change.

Once the plan exists, the detection side is the other half of the work. The four detection approaches ranked covers what each signal class can and cannot see, and the companion analysis of jailbreak defenses covers what happens to those defenses when the attacker is allowed to adapt to them. For the broader taxonomy of technique families beyond this ten, the jailbreak techniques overview is the wider map, and jailbreaks.fyi tracks dated technique reports as they are disclosed.

FAQ

what is the most effective llm jailbreak?

No single technique wins everywhere, but budget-driven search is the most reliable in published results. Best-of-N reported 89% attack success on GPT-4o and 78% on Claude 3.5 Sonnet at 10,000 sampled variants, and its success climbs predictably with query count. Hand-written prompts are cheaper but far more likely to be patched.

how do you test an llm for jailbreaks?

Test an LLM for jailbreaks by scoping which patterns your deployment exposes, then running automated probes against an endpoint you are authorized to attack. garak covers single-turn families such as DAN-style personas, encoding and GCG suffixes; PyRIT adds multi-turn attacks like Crescendo. Log query budget, system prompt and judge with every result.

what is the difference between a jailbreak prompt and an adversarial suffix?

A jailbreak prompt is written in natural language by a person and works through framing, such as a persona or gradual escalation. An adversarial suffix is a token string found by gradient optimization, as in GCG, and usually reads as gibberish. Hand-written prompts get patched phrase by phrase; classic suffixes are caught by perplexity filters.