Safety
Jailbreak
A jailbreak is an attempt to make a model bypass its own safety training, usually through role-play framing, mode-switch phrasing or hypothetical scenarios.
It differs from prompt injection in target: injection attacks the application’s instructions, a jailbreak attacks the model’s training. Both arrive as text and both are mitigated by treating untrusted input as untrusted.
Published patterns are detectable with pattern matching, which catches opportunistic and copy-pasted attempts. Novel or paraphrased attempts are not.
In practice
Worth distinguishing from prompt injection, because they need different defences. A jailbreak is the user attacking their own session to get output the model would normally decline — the damage is bounded by what that user can see. An injection is a third party attacking someone else's session through content the model reads, and the victim never sees the instruction.
Common questions
What is the difference between a jailbreak and a prompt injection?
Who the attacker is. A jailbreak is a user attacking their own session, so the damage is bounded by what that user can already see. An injection is a third party attacking someone else's session through content the model reads.
Can jailbreaks be fully prevented?
No. Providers harden against known patterns and new ones appear. The engineering response is to assume the model can be made to say anything and to place the real limits in code — permissions, validation, spend ceilings.