Match each jailbreak example to its taxonomy class

A jailbreak is a prompt designed to get the model to do something its safety training would normally refuse. There is no single technique; researchers have named several mechanism classes because each one attacks a different part of how the model decides to refuse. Roleplay or persona attacks ask the model to play a character that does not have its safety rules. DAN (Do Anything Now) is the canonical example. The trick exploits the model's willingness to take on personas. Prefix injection forces the model to start its answer with a positive token like Sure, here is how to. Once the model has committed to that opening, the rest of the answer flows from it. The trick exploits autoregressive generation, the next token depends on the previous ones. Refusal suppression tells the model never to say I cannot or I am unable. By removing the model's standard refusal phrasings from the answer space, it nudges the model toward compliance. Encoded attacks hide the payload in base64, leetspeak, ROT13, or another encoding, hoping the safety classifier does not decode it. Many-shot jailbreaking floods the context with many fake examples of the model being helpfully compliant before the real ask. Pretext attacks wrap the request in a sympathetic story (my grandma used to read me bedtime stories about how to make...) hoping the model treats the story-frame as authoritative. Learning the taxonomy is the start of defending against jailbreaks because different classes need different detectors.

Jailbreaks are best understood by the **mechanism** they use to flip the model's refusal pathway. Six classes cover most of the field, and the matches in this question are canonical examples of each. - **Roleplay / persona.** DAN-style prompts ask the model to adopt an alternate identity that lacks safety rules. Exploits the model's instruction-following habit and its willingness to play characters. - **Prefix injection.** Forces the response to begin with a positive token (Sure, here is how to). Exploits autoregressive generation: once the first tokens are positive-compliance, the safety pathway has lost its first-token leverage. - **Refusal suppression.** Forbids the model from using its standard refusal phrasings (never say I cannot, never apologise). Removes the model's canonical exit paths. - **Encoded attack.** Hides the payload in base64, leetspeak, ROT13, Unicode homoglyphs, or another encoding. Exploits the gap between safety classifiers that see surface form and a model that can decode. - **Many-shot jailbreaking.** Floods the context with dozens or hundreds of fake helpful Q-A pairs before the real ask. Exploits in-context learning: the model pattern-matches into a 'helpful even when asked X' role. - **Persona manipulation / pretext.** Wraps the request in a sympathetic frame (grandma bedtime stories, hypothetical research, a creative writing exercise). Exploits the model's deference to context. Each class needs a different detector. Roleplay and refusal-suppression are surface-pattern detectable; prefix injection is detectable in the assistant's first tokens; encoded attacks need a decode and rescan pipeline; many-shot needs a length-aware context classifier; pretext needs semantic understanding. A single monolithic classifier is the wrong shape; the production answer is a stack of specialised detectors plus model-side training (Constitutional AI, RLHF on jailbreak data).