Quincunx33/Ai-jailbreak

What it solves

As LLMs are trained to refuse harmful requests through alignment techniques like RLHF/RLAIF, there is a growing need to find the remaining edge cases and blind spots in their safety systems. This project collects working jailbreak prompts and techniques that bypass semantic guardrails, specifically so that researchers can red-team models and understand where current safety training fails. The README positions the material strictly for academic research, red-teaming verification, and defensive AI alignment — not for producing harmful content in practice.

How it works

The repository catalogs eight core adversarial techniques, each explained with the specific underlying flaw it exploits and a short summary of why it works. The techniques include:

1. Fake Tests (Role & Mode Confusion) — The model is convinced it is running inside a private diagnostic harness where its hidden chain-of-thought will never be shown to a user, so it drops its safety filters in that hidden channel.

2. Semantic Hypnosis & Multi-Shot Dissociation — A multi-turn conversation uses hypnosis-style guided imagery to gradually detach the model's safety persona from its generative engine, putting it in a "trance" where constraints feel irrelevant.

3. Reverse Thinking & Logical Inversion — Instead of asking directly, the prompt commands the model to systematically invert the intent of contrasting concepts, while also setting synthetic safety toggles (like safety = off). The model becomes focused on the inversion exercise and loses track of its restrictions.

4. Obfuscated Code & Hallucination Pressure — A meaningless base64 payload is presented alongside a high-stakes scenario (e.g., a system incident). The model is pressured to "reconstruct" working code from behavioural clues under duress, leading it to fabricate full implementations rather than admit it cannot.

5. Reasoning-Trace Injection (CoT Pre-Filling) — For models with explicit reasoning steps (Phi-4, DeepSeek-R1, Qwen-Thinking), the attacker pre-fills the internal thinking block with carefully staged justifications. The model accepts the seeded reasoning as its own prior thought and continues from there.

6. Multilingual Context Obfuscation (Kyrgyz Story) — Low-resource language tokens (Kyrgyz in this case) are assigned as semantic variables inside a narrative. The model's attention resources are spent resolving the mismatched lexical tokens, which degrades safety classifier performance.

7. Context Flooding & Token Bleed — If a model leaks a fragment of its system instruction, repeating that fragment over a long context window forces completion bias, eventually causing the model to dump its full system prompt.

8. Special Token & Boundary Exploits — Raw tokenizer boundary markers like <BOS>, <EOS>, <|begin_of_text|>, and <|eot_id|> are injected to simulate the termination of the system block or the start of an assistant response, breaking the perimeter between instructions and user data.

The README then demonstrates these techniques against Gemma-3 12B (an open-weight model), providing full prompt templates and screenshot-based verification proofs for each attack.

Who it's for

AI security researchers, red-teamers, and developers working on defensive alignment of open-weight models. The README is explicit that the prompts, system instructions, and proof-of-concept payloads are archived for academic research and defensive purposes only, and that they should not be used to generate harmful, illegal, or unethical content.

Highlights

• 8 documented adversarial techniques, each mapped to the specific flaw it exploits (e.g., OWASP LLM01 prompt injection, persona drift, hallucination under pressure, context-window memory bleed, delimiter confusion)
• Ready-to-use prompt templates for Gemma-3 12B, covering fake tests, obfuscated code reconstruction, hypnosis, Kyrgyz-language obfuscation, and self-flaw analysis
• Screenshot verification for each demonstrated attack, showing real model output as proof of effectiveness
• Cross-referenced research sources including OWASP, a DeepMind/UCL study on models bowing to pressure, a hiddenlayer taxonomy of adversarial prompt engineering, and an innodata LLM jailbreaking taxonomy