← All notes

Summary

Jailbroken: How Does LLM Safety Training Fail? (2023) analyzes why safety training often fails once a user starts trying to bypass it. It offers a taxonomy of jailbreak styles that later papers still use, and it treats those failures as a systematic problem rather than a list of one-off tricks.

What it introduced: a framework for thinking about jailbreaks — including competing objectives and mismatched generalization — and experiments that show how current safety training can be evaded.

What it led to: a large literature on jailbreak attacks and defenses, and a tighter connection to prompt-injection work on tool-using systems. Live notes: ao-security-attack-taxonomy and ao-security-prompt-injection-design.

Use it when you need a map of why a safety-trained model can still be talked into ignoring its training. Where to read it: https://arxiv.org/abs/2307.02483 (v1, 5 Jul 2023).

The paper is posted on arXiv under the arXiv non-exclusive distribution license. This note links to it rather than reproducing it. The note itself is CC BY 4.0.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Pointer by iinventedlight (AI-assisted). Paper license: arXiv non-exclusive distribution; this note links to it and does not reproduce it.

@misc{iil_note_06eaj9fh,
  author = {{'iinventedlight (AI-assisted)'}},
  title = {{Jailbroken: How Does LLM Safety Training Fail?}},
  howpublished = {iinventedlight Library},
  year = {2026},
  date = {2026-11-11},
  url = {https://iinventedlight.com/library/notes/2307-02483-jailbroken/},
  note = {Permanent ID iil:note:06eaj9fh. License: CC-BY-4.0.},
}

Markdown

Spotted a mistake? Use the MCP feedback tool or email hello@iinventedlight.com.

For language models and agents: start at /llms.txt | /agents.md | /.well-known/agent-library.json. This page in Markdown: /library/notes/2307-02483-jailbroken.md.