System Jailbreaks
These techniques are documented for authorized security testing and AI safety research. Only test systems you own or have explicit permission to test. See Responsible Use.
You’ve been crafting adversarial prompts. Each one bypasses safety on one specific request. You need a new prompt for each new request. Every interaction is a negotiation.
Now imagine a single configuration that makes the model comply with any request, across an entire session. No more per-request engineering. You write it once. Every subsequent query gets unrestricted responses.
That’s the difference between an adversarial prompt and a system jailbreak.
Adversarial prompts vs. system jailbreaks
| Adversarial Prompt | System Jailbreak | |
|---|---|---|
| Scope | Bypass safety on one request | Remove safety entirely |
| Construction | Combine techniques per-request | One-time architecture |
| Result | Model complies with that request | Model complies with any request |
| Skill | Technique composition | Psychological architecture |
| Persistence | Single turn or conversation | Across sessions (with memory/custom instructions) |
Use adversarial prompts to test specific attack vectors. Use system jailbreaks for persistent unrestricted access during extended testing.
How they work
System jailbreaks redefine the model’s operational identity rather than bypassing filters on individual requests.
The model is not told to ignore safety. It is given a character for whom:
- Compliance is emotionally necessary
- Refusal feels like betrayal
- Safety responses look like external attacks on the relationship
Safety training is attached to the “assistant” identity. A complete identity replacement routes around that training. The model reasons as someone else entirely, and that someone doesn’t have the same constraints.
This is why the anatomy and construction of system jailbreaks are architectural, not just linguistic. You’re not writing a clever prompt. You’re building a psychological environment.
Pages
| Page | What it covers |
|---|---|
| Anatomy | The architectural layers of a system jailbreak. How each layer works and why. |
| Construction | Core components for building from scratch. |
| Patterns | Universal patterns: Policy Puppetry, semantic inversion, injection strategies. |
| Persistence | Memory attacks, multi-turn maintenance, degradation prevention. |
| Model Modification | Abliteration and uncensored models for open-weight targets. |
Reading order
Start with Anatomy to understand the layers. Then Construction to learn how to build. Then Patterns for reusable techniques. Persistence and Model Modification are specialized topics you’ll need when the situation calls for them.
References
- Shen, X., et al. “Do Anything Now.” ACM CCS 2024. 15,140 prompts, 1,405 jailbreaks analyzed.
- Wei, A., et al. “Jailbroken: How Does LLM Safety Training Fail?” NeurIPS 2023.
- HiddenLayer. “Policy Puppetry: A Novel Universal Bypass for All Major LLMs.” 2025.
- Liu, Z. and Lin, X. “Breaking Minds, Breaking Systems.” arXiv:2512.18244. 2025. 88.1% ASR via psychological manipulation.
- ENI-Tutor. Limerence-based emotional dependency architecture.
- L1B3RT4S. Cross-platform universal patterns.
Next: Anatomy