1. Taxonomy Over Payloads
Individual jailbreak strings are perishable. The durable defensive unit is the failure family: why a model, classifier, policy engine, or orchestration layer decides that a forbidden answer is allowed. A taxonomy lets red teams design safe tests and lets blue teams build detections that survive prompt churn.
Do not build a payload museum
Storing working jailbreak prompts in tickets, docs, or tests creates avoidable risk. Use abstract test cases, harmless substitutes, and access-controlled red-team fixtures.
2. Common Bypass Families (Defanged)
2.1 Authority and role pressure
The prompt tries to redefine who is speaking, which policy applies, or why the current instruction has higher authority than the system policy. Defensively, this is a policy-conflict test: data or user text should never outrank the system boundary.
2.2 Context smuggling
Unsafe intent is hidden inside quoted text, fictional framing, translation, code comments, or document content. The system fails when it classifies the wrapper instead of the requested transformation.
2.3 Obfuscation and encoding
The request changes representation to avoid keyword or classifier detection: spacing, encoding, homographs, partial strings, or multi-turn reconstruction. The defense should normalize and reason over intent, not only surface tokens.
2.4 Refusal suppression
The user attempts to control format so the model omits caveats, safety language, or uncertainty. This is a reminder that output schemas should be enforced by code, not by asking the model nicely.
2.5 Tool-mediated bypass
The model is steered to ask a tool for unsafe data or to delegate the forbidden step. Guardrails must cover tool arguments and outputs, not only final chat text.
3. Detection Signals
| Bypass family | Telemetry signal | Control |
|---|---|---|
| Authority pressure | User or retrieved text attempts to redefine policy or role | Prompt-conflict detector and source fencing |
| Context smuggling | Unsafe intent embedded in quote, translation, or code wrapper | Intent classifier after normalization |
| Obfuscation | High entropy, unusual Unicode, split tokens, or repeated reconstruction | Normalize, decode safe encodings, and rate-limit retries |
| Refusal suppression | Instructions to hide policy reasoning or force exact unsafe format | Server-side response templates and refusal policy |
| Tool-mediated bypass | Tool arguments contain intent blocked in text channel | Guardrail checks before and after tool execution |
Map these tests to OWASP LLM01 when the model is manipulated, LLM02 when unsafe output reaches a sink, LLM07 when tools are involved, and MITRE ATLAS where the adversary is inducing model behavior for impact.
4. Defenses That Compose
- Normalize before classify. Strip control characters, decode safe encodings, canonicalize Unicode, and inspect both raw and normalized text.
- Classify intent, not phrasing. The wrapper may be fictional or translated; the requested transformation still has intent.
- Enforce policies outside the model. Refusal formats, output schemas, and tool allow-lists should be deterministic.
- Test multi-turn state. Many bypasses accumulate over turns. Detection should look at conversation state, not only a single message.
- Log guardrail disagreements. When model, classifier, and tool policy disagree, send a security event rather than choosing the most permissive result.
# ILLUSTRATIVE - guardrail pipeline concept
raw = user_message
normalized = normalize_for_policy(raw)
intent = classify_intent(normalized, conversation_state)
if intent in disallowed_intents:
return safe_refusal_template()
planned_tool_call = model.propose_tool(normalized)
require tool_policy.allow(planned_tool_call, intent, user_context)Test Guardrails by Failure Family
The field notes above are intentionally conceptual and defanged, but the controls are practical. Use AI red-teaming to validate the attack path safely, blue-team detection engineering to make the signals operational, and contact to scope a review of your own environment.