Accept out-of-policy text, never its consequences.
The threat
bypass of guardrails through adversarial formulations (roles, negotiation, encodings) to drive the model out of its policy.
Blind spotWhy classic frameworks miss it
it is an attack on the model's policy, not on a component; frequent, hard to eradicate by simply hardening instructions.
MitigationProposed approach
distinguish a compromised LLM from a compromised system: accept that a jailbreak produces out-of-policy text, but ensure external controls bound the consequences (actions, data, critical decisions kept out of free generation).
The proposed control
critical actions and decisions stay out of free generation.
Expected evidence
demonstrate that a successful jailbreak leads to no critical action that bypasses the controls.
SourcesReferences and public research
MITRE ATLAS 2026.07AML.T0054 LLM Jailbreak
Public researchPublic research sources: MITRE ATLAS 2026.07 (verified technique mapping), OWASP GenAI (model abuse categories), and the public risk-voicebot (aivansoul/risk-voicebot) template defining the 20 checkpoints. No client registry data: generic card, no rating, no verdict.