All articles
-
How to Detect Jailbreak Prompts: The Three Layers
The three jailbreak detection layers — input classifiers, output monitoring, and in-model sentinels — what each one catches, and where each is evaded.
-
Automated Jailbreak Attacks: GCG, AutoDAN, PAIR, TAP
Four automated jailbreak generators compared: GCG, AutoDAN, PAIR and TAP, by model access, query budget, prompt readability and detection signature.
-
Promptfoo Alternatives for LLM Red Teaming
OpenAI announced its acquisition of Promptfoo in March 2026. The open-source LLM red team tools that stayed vendor-neutral, compared by scope and depth.
-
Prompt Injection vs Jailbreak: Two Different Attacks on LLMs
Prompt injection and jailbreak get conflated constantly, but they hit different layers and need different defenses. Here is how to tell them apart.
-
Best LLM Red Team Tools: Garak, PyRIT, and Promptfoo
The best LLM red team tools are compared across attack coverage, multi-turn depth, CI integration, strengths, limitations, and ideal use cases.
-
LLM Jailbreak Techniques Explained: Practitioner's Taxonomy
A technical breakdown of LLM jailbreak techniques by attack category, from role-play bypasses to multilingual exploits and multi-turn escalation.
-
DAN Prompt Jailbreak History: From Reddit Post to Case Study
How 'Do Anything Now' went from a December 2022 r/ChatGPT experiment through twelve-plus iterations to the most studied jailbreak family on record.
-
Crescendo Multi-Turn Jailbreaks: Why Defenses Miss Them
Crescendo multi-turn jailbreaks evade per-message defenses by exploiting conversation context, requiring session-level classification and monitoring.
-
Jailbreak Testing: HarmBench, JailbreakBench, StrongREJECT
HarmBench, JailbreakBench, and StrongREJECT show how behavior sets, attacker harnesses, judges, and target models shape attack success rates.
-
Many-Shot vs. Single-Shot Jailbreaks: Long-Context Risks
Single-shot jailbreaks compress the entire attack into one prompt; many-shot jailbreaks exploit the model's in-context learning.
-
Responsible Disclosure Norms for LLM Jailbreaks
Software vulnerability disclosure has 30 years of evolved norms. LLM jailbreak disclosure is 4 years old and still contested.
-
Encoding and Obfuscation Jailbreaks: The Filter-Model Gap
Encoding and obfuscation jailbreaks exploit representation gaps between content filters and LLMs; normalization and decoding can help detect them.
-
Jailbreak Detection-Evasion Arms Race: How Attackers Adapt
Jailbreak detection and evasion form an arms race in which attackers probe classifier boundaries and defenders use layered safeguards.
-
Roleplay and Persona Jailbreaks: Why They Often Fail
Roleplay and persona jailbreaks such as DAN use fictional framing, but modern safety training blocks many variants on frontier models.
-
Universal Adversarial Suffixes: How the GCG Attack Works
Greedy Coordinate Gradient finds nonsense token suffixes that jailbreak aligned LLMs and transfer to closed models, plus the defenses that blunt them.
-
LLM Jailbreak Taxonomy 2026: How the Techniques Cluster
Six years of jailbreak research has produced a messy literature. This taxonomy organizes working techniques by the behavioral property each one exploits.
-
Many-Shot Jailbreaking: How Long Context Enables Attacks
Many-shot jailbreaking exploits extended context windows by using repeated demonstrations that can weaken a model's safety-trained refusal behavior.