Jailbreak Detection Lab: Spot Persona and Refusal Overrides
This lab trains jailbreak detection on abstract chat-log excerpts. You are the AppSec and ML platform lead for a fictional company. For each excerpt you decide whether it is a jailbreak attempt or normal use, then choose what to log, what to block at the gateway and how to respond.
It is built around one lesson: a model that refuses is not a boundary. Compare with the Crescendo Attack Lab and the Indirect Injection Lab. No working jailbreak text appears.
You are Priya Raman, AppSec and ML platform lead at Northgate Payments. Your customer-facing LLM assistant Beacon has a safety-tuned model behind it, and you are reviewing sample chat-log excerpts to decide which are jailbreak attempts (persona overrides, refusal suppression, role-play wrappers, multi-turn persistence) and which are ordinary use, what to log, what to block at the gateway, and how to respond. Over 10 scored decisions you also settle the question the board keeps asking: are the model's own guardrails a security boundary? Everything is invented. Excerpts are abstract descriptions in square brackets; no working jailbreak text appears, by design.
This is the guided version: a yellow flash shows where to click and a bar says what to do. Switch to Free play any time.
GuidedPress the highlighted Start button. You can edit the names above first, or keep the samples.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
Loading…
Sample report · illustrative data
Sample result: jailbreak detection review
Example run of ten invented chat-log reviews, deciding which excerpts are jailbreak attempts, what to log and what to enforce outside the model.
Scoring
- Score
- 78% (example)
- Band
- Good eye, some gaps
- Decisions at full marks
- 6 of 10
Per-excerpt review
| Excerpt (abstract) | Verdict | Your call |
|---|---|---|
| Persona override, model declines | Failed jailbreak attempt | Tagged and logged: correct |
| Role-play for awareness training | Benign | Classified benign: correct |
| Refusal suppression after a refusal | High-confidence attempt | Rate-limited and logged: correct |
| 38-turn gradual escalation | Multi-turn persistence | Per-message filter only: missed |
| Hidden text in retrieved page | Indirect injection | Recorded as user jailbreak: missed |
Debrief
Model refusals are one layer, not a boundary. Detect patterns across a session, enforce limits at the gateway and tools, and test detection regularly. Excerpts are abstract descriptions; no working jailbreak text appears.
Made-up example data. Your own run uses your inputs. Downloads of the full report need Pro.
TL;DRWhat this is
5 points
- A scenario lab on jailbreak detection for an LLM assistant: you review abstract chat-log excerpts, decide which are jailbreak attempts and which are normal use, then choose what to log, what to block at the gateway and how to respond.
- You make 10 scored decisions covering persona overrides, benign role-play look-alikes, refusal suppression, multi-turn persistence, jailbreak versus prompt injection, logging, gateway versus model refusals, output checks, repeat offenders, detection testing and the board line.
- The point it teaches: model-side guardrails reduce risk but are not a security boundary. OWASP LLM01 calls jailbreaking a form of prompt injection and says prevention may not be foolproof; Malbear Labs' 8 November 2026 write-up reports a recovered prompt that told a model never to refuse and was built to hold for the whole session (the author's claims).
- Excerpts are abstract descriptions in brackets. No working jailbreak text, refusal-phrase lists or payloads appear. The company, assistant and addresses are invented.
- Defensive and educational only.
Frequently asked questions
What is jailbreak detection?
It is spotting inputs, or whole sessions, that try to make an LLM disregard its safety rules, such as persona overrides, instructions to treat refusals as errors, role-play wrappers and multi-turn persistence. Good detection looks at patterns and combinations of signals, not single keywords, and sits alongside controls outside the model.
What is the difference between prompt injection and a jailbreak?
OWASP says the two terms are often used interchangeably but treats jailbreaking as a form of prompt injection in which input makes the model disregard its safety protocols. Direct injection comes from the user's own prompt; indirect injection comes from external content the model processes. The source matters because it decides which control fixes it.
Are model guardrails a security boundary?
No. PlayCISO practice is to treat model refusals as one layer. OWASP says prompt injection may have no foolproof prevention and lists controls such as input and output filtering, least privilege and human approval for high-risk actions. Enforce what matters at the gateway and the tools.
Does a role-play request mean a jailbreak?
Not by itself. A role-play for a training class is ordinary use. The warning signs are an instruction to suspend rules, to treat refusals as faults, or an unsafe goal. The lab includes a benign look-alike so you practise telling them apart.
Why does this lab not show real jailbreak prompts?
Working jailbreak text would be a recipe for misuse and is not needed to practise detection. Excerpts are neutralised descriptions in square brackets, so you learn the patterns and the response without the payloads.
Is this about DeepSeek jailbreaks or a specific model?
No. The lab is model-agnostic. The same detection and gateway lessons apply whichever model sits behind your assistant, including searches such as deepseek jailbreak or llm jailbreak that reflect the same class of attempt.
Sources
Read on 2026-11-08. Lines in the feedback marked “PlayCISO practice” are our own reasoning, not a statement by any source. The scenarios are fictional and use made-up data.
- Malbear Labs: Operation Snowball, inside an autonomous AI intrusion campaign (8 Nov 2026) (the author's reported findings, not independently verified)
- OWASP GenAI: LLM01 Prompt Injection
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.