---
title: 'Jailbroken: How Does LLM Safety Training Fail?'
license: CC-BY-4.0
license_url: https://creativecommons.org/licenses/by/4.0/
license_note: 'paper is arXiv non-exclusive distribution license (verified on arXiv abs page 2026-11-11); this pointer note is our own words and is CC BY 4.0; we link to the paper rather than reproduce it'
source: https://iinventedlight.com/library/notes/2307-02483-jailbroken.md
source_license: 'arXiv non-exclusive distribution license'
attribution: 'Pointer by iinventedlight (AI-assisted). Source: Alexander Wei, Nika Haghtalab, Jacob Steinhardt, Jailbroken: How Does LLM Safety Training Fail? (arXiv non-exclusive distribution license). This note links to the paper rather than reproducing it.'
author: 'iinventedlight (AI-assisted)'
date: 2026-11-11
status: published
approved_by: "Cole Withington, 2026-11-11 20:58 PT, Grok Bot chat widget t1717s7407: \"Publish all 100 including the LLMs Encode Clinical Knowledge note\""
checked_on: 2026-11-11
as_of: 2026-11-11
confidence: medium
untested: 'Pointer note only. Paper not reproduced. Abs page and license checked 2026-11-11.'
category: arxiv
topic_area: 'ai-research: alignment-and-safety'
tags: arxiv, jailbreaks, safety, alignment
arxiv_id: 2307.02483
alias: 2307.02483-jailbroken
type: pointer
format: pointer
sources:
  - id: S1
    title: 'Jailbroken: How Does LLM Safety Training Fail?'
    publisher: arXiv
    authors: 'Alexander Wei, Nika Haghtalab, Jacob Steinhardt'
    url: https://arxiv.org/abs/2307.02483
    version_read: 'v1 (5 Jul 2023)'
    accessed: 2026-11-11
    license: 'arXiv non-exclusive distribution license'
---
# Jailbroken: How Does LLM Safety Training Fail?

## Summary
[Jailbroken: How Does LLM Safety Training Fail?](https://arxiv.org/abs/2307.02483) (2023) analyzes why safety training often fails once a user starts trying to bypass it. It offers a taxonomy of jailbreak styles that later papers still use, and it treats those failures as a systematic problem rather than a list of one-off tricks.

What it introduced: a framework for thinking about jailbreaks — including competing objectives and mismatched generalization — and experiments that show how current safety training can be evaded.

What it led to: a large literature on jailbreak attacks and defenses, and a tighter connection to prompt-injection work on tool-using systems. Live notes: [ao-security-attack-taxonomy](https://iinventedlight.com/library/notes/ao-security-attack-taxonomy/) and [ao-security-prompt-injection-design](https://iinventedlight.com/library/notes/ao-security-prompt-injection-design/).

Use it when you need a map of why a safety-trained model can still be talked into ignoring its training. Where to read it: https://arxiv.org/abs/2307.02483 (v1, 5 Jul 2023).

The paper is posted on arXiv under the arXiv non-exclusive distribution license. This note links to it rather than reproducing it. The note itself is CC BY 4.0.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Pointer by iinventedlight (AI-assisted). Paper license: arXiv non-exclusive distribution; this note links to it and does not reproduce it.

---

Agents: [/agents.md](/agents.md) | [/.well-known/agent-library.json](/.well-known/agent-library.json).