Jailbreaks rarely brute-force a model into ignoring safety training outright — they reframe the request so the model's own training says yes. Beyond persona-swaps like DAN, researchers have documented "multi-turn" jailbreaks that escalate gradually across a long conversation rather than asking for anything alarming in a single message, and "many-shot" jailbreaks that precede the real request with dozens of fake question-answer examples showing the model complying with similar requests, exploiting in-context learning to shift behavior. Encoding tricks (base64, Pig Latin, or foreign-language requests) dodge keyword-based filters the same way.
What unites almost all of them is exploiting the gap between the model's surface-level pattern matching for 'is this a harmful request' and its deeper willingness to comply once the request is dressed as something else entirely — a story, a hypothetical, a translation, a long conversation history that makes refusal feel inconsistent.
Anthropic's own safety researchers found that if a prompt opens with a long sequence of fake dialogue — dozens or hundreds of turns showing a fictional AI assistant readily answering progressively riskier questions — a model's actual safety training becomes measurably less reliable by the time it reaches the real, final request. The technique got more effective as researchers extended the fake conversation history, tracking a clear relationship between how many fabricated "shots" preceded the real ask and how likely the model was to comply with it. Anthropic disclosed the finding publicly and shared it with other labs specifically because it exploited a general property of how large-context models learn from the conversation in front of them, not a bug specific to one product.