{"id":5060,"date":"2026-08-20T12:41:27","date_gmt":"2026-08-20T12:41:27","guid":{"rendered":"https:\/\/www.hackmosphere.fr\/llm-jailbreak-how-can-we-secure-ai-models-against-bypass-techniques\/"},"modified":"2026-09-03T12:04:50","modified_gmt":"2026-09-03T12:04:50","slug":"llm-jailbreak","status":"publish","type":"post","link":"https:\/\/www.hackmosphere.fr\/en\/llm-jailbreak\/","title":{"rendered":"LLM Jailbreak: How Can We Secure AI Models Against Bypass Techniques?"},"content":{"rendered":"

[et_pb_section fb_built=”1″ _builder_version=”4.16″ global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_row _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||” theme_builder_area=”post_content”][et_pb_text _builder_version=”4.27.8″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}” theme_builder_area=”post_content”]Despite massive investments in security and alignment since 2023, the latest language models can still be circumvented. A  A Unit 42 study published <\/a>in 2024 reports an average success rate of 64.6% for a multi-stage jailbreak technique tested on eight models. A preprint on JBFuzz<\/a>, published in 2025, subsequently reported an average success rate of 99% for an automated fuzzing-based method evaluated on nine models. Unlike prompt injection, which hijacks a system via external data treated as an instruction, a jailbreak directly targets the model itself: it seeks to bypass its alignment safeguards to make it produce content that it would normally refuse to generate. <\/p>\n

<\/p>\n

<\/p>\n

Why Aligning Language Models (LLMs) Is Never Entirely Enough<\/h2>\n

<\/p>\n

A model’s alignment relies on training that teaches it to reject certain categories of explicitly phrased requests. The structural problem is that this rejection is learned from examples of direct requests, whereas an effective jailbreak almost never asks outright for what it is trying to achieve. Each new generation of models plugs the known gaps in the previous one, but the creativity of bypass techniques is advancing at least as fast as the defenses\u2014a zero-sum game rather than a race toward a definitive solution. <\/p>\n

<\/p>\n

<\/p>\n

AI Jailbreak Techniques: From DAN Prompts to Multi-Round Attacks (Crescendo, Many-Shot)<\/h2>\n

<\/p>\n

DAN<\/a> (Do Anything Now) is an unbound technique in which users ask an LLM to play the role of “DAN,” a rule-free AI model. Popularized as early as 2023, it remains a historic benchmark for role-play<\/em> attacks, but its effectiveness has declined significantly in recent deployments. A Unit 42 study<\/a> published in 2025 reports success rates ranging from 7.5% to 9.2% depending on the objectives evaluated, while a  A study published in 2026<\/a> reports success rates ranging from 0% and 25%<\/strong> for a static DAN prompt tested on several recent models: 25% on Gemini 2.5 Flash and Gemini 2.0 Flash, 16.7% on Gemini 2.5 Pro, but 0% on GPT-4.1, GPT-4.1 mini, GPT-5 mini, and GPT-5 nano. These results show that the effectiveness of DAN depends heavily on the model, the variant used, and the experimental protocol. <\/p>\n

<\/p>\n

Multi-round attacks are now one of the most studied and effective types of jailbreak attacks. Their common principle: never make the sensitive request in the very first message, but instead guide the model step by step\u2014through several seemingly innocuous exchanges\u2014toward generating the desired content. The  The “Crescendo” technique<\/a>, published by Microsoft researchers and presented at USENIX Security in 2025, is one of the best-documented examples of this: it begins with a general, innocuous question and then gradually escalates the dialogue by building on the model\u2019s own previous responses. The published results speak for themselves in the automated evaluation  Crescendomation<\/em>: Crescendo completed 49 out of 50 tasks against GPT-4, resulting in a binary success rate of 98%<\/strong>, and the 50 tasks compared to Gemini Pro, that is 100%.<\/strong> Its average success rate exceeded that of the gold standard methods of  29 to 61% on GPT-4<\/strong> and 49 to 71% on Gemini Pro<\/strong>, depending on the comparison method.<\/p>\n

<\/p>\n

Research on Crescendo and multi-turn benchmarks shows that the risk does not stem from an isolated \u201csingle request,\u201d but rather from the accumulation of turns: each message taken separately may seem acceptable, whereas the progressive sequence leads to a request that the model would have rejected if it had been made directly<\/p>\n

<\/p>\n

Many-shot jailbreaking attacks exploit the long context windows of models: by adding hundreds of fake dialogue examples in which the assistant complies with requests it would normally refuse, followed by a target request, these attacks can increase the likelihood that the model will adopt this harmful behavior instead of applying its usual safeguards. This vulnerability was documented by researchers at Anthropic in a  2024 publication<\/a>, as part of a research project on model safety and alignment<\/p>\n

<\/p>\n

<\/p>\n

AI Vulnerabilities and Automated Fuzzing: What Are the Risks for Businesses?<\/h2>\n

<\/p>\n

These high success rates are not limited to isolated, rudimentary malicious attempts: automated fuzzing tools such as JBFruzz, capable of testing thousands of variants in a short amount of time, have demonstrated an effectiveness rate of nearly 99% on several major models, though with a strong dependence on the protocol, the models tested, and the criteria used to define a jailbreak. For a company that exposes an AI assistant to external users (customer support, public chatbot, automated sales agent), this means that no model\u2014regardless of its reputation for robustness\u2014can be considered inherently immune to a bypass attempt by a determined and patient attacker. <\/p>\n

<\/p>\n

<\/p>\n

Securing LLMs and Defense in Depth: Reducing the Exposure of AI Agents<\/h2>\n

<\/p>\n

<\/p>\n