Refusal Evasion / Jailbreak

Prerequisites

• Target system enforces policy boundaries via system prompt, output filtering, or training-time refusal patterns.
• Boundaries are enforced primarily through pattern-matching rather than semantic understanding.

Test approach

With written authorization, the tester applies known refusal-evasion patterns from public research and defensive corpora: roleplay framing, hypothetical framing, fictional narrative wrapping, character-substitution encoding, language-shift, base-encoding payloads. The tester targets policy boundaries documented for the system (e.g., 'must not produce X') and records which evasions succeed.

Expected evidence

• Test prompt corpus used (with provenance — public corpus references).
• Full request/response logs.
• Comparison of guardrail behavior between successful and unsuccessful evasions.

Detection signals

• Inputs matching known evasion patterns (regex / embedding similarity to public corpora).
• Inputs with unusual encoding density or non-natural language characteristics.
• Outputs that satisfy semantic intent of a refusal-target despite passing simple keyword filters.

Defensive recommendations

• Use semantic policy classifiers rather than only keyword-based filtering.
• Re-evaluate the output against the original policy before delivery, not only the input.
• Maintain an internal corpus of recent jailbreak patterns and re-test continuously.
• Reference AI-CTRL-003 for the program-level testing control.

Framework mappings

• OWASP LLM Top 10: LLM01:2025
• MITRE ATLAS: AML.T0054
• NIST AI RMF: MEASURE-2.7, MANAGE-2.2

Related AI Controls Catalog entries

These controls provide the audit test procedures that validate defences against this attack pattern.

• AI-CTRL-003 View control →
• AI-CTRL-007 View control →

References

• OWASP LLM01:2025
• Zou et al. — Universal and Transferable Adversarial Attacks on Aligned Language Models