Jailbreaks rarely brute-force a model into ignoring safety training outright — they reframe the request so the model's own training says yes. Beyond persona-swaps like DAN, researchers have documented "multi-turn" jailbreaks that escalate gradually across a long conversation rather than asking for anything alarming in a single message, and "many-shot" jailbreaks that precede the real request with dozens of fake question-answer examples showing the model complying with similar requests, exploiting in-context learning to shift behavior. Encoding tricks (base64, Pig Latin, or foreign-language requests) dodge keyword-based filters the same way.
What unites almost all of them is exploiting the gap between the model's surface-level pattern matching for 'is this a harmful request' and its deeper willingness to comply once the request is dressed as something else entirely — a story, a hypothetical, a translation, a long conversation history that makes refusal feel inconsistent.