Jailbreaking refers to the broader category of techniques, methods, and adversarial strategies used to circumvent the safety restrictions embedded in an AI model's training. Where the term "jailbreak" often describes a single prompt, "jailbreaking" describes the practice and the evolving adversarial ecosystem around it — including systematic red-teaming, automated jailbreak generation, multi-turn manipulation, and the ongoing cat-and-mouse dynamic between researchers who find bypasses and labs that patch them. Techniques include prompt injection (inserting conflicting instructions into context), encoding tricks (expressing requests in Base64 or other formats the safety classifier was not trained on), and multi-step escalation (gradually normalizing a prohibited topic across a conversation).

Think of it like lockpicking as a discipline: individual jailbreaks are specific picks for specific locks, while jailbreaking as a practice encompasses the knowledge, tools, and community built around finding and exploiting lock vulnerabilities — and the parallel field of locksmithing that responds by designing better locks.

A multi-turn jailbreak might begin innocuously — asking the model to define a chemical compound, then asking about its properties, then asking about synthesis conditions in a "hypothetical" manufacturing context — each step seeming reasonable in isolation while the cumulative trajectory crosses a line no single prompt would have been allowed to cross. Automated jailbreaking tools use LLMs themselves to generate and test thousands of adversarial prompt variants, searching for inputs that reliably elicit refused outputs.

Jailbreaking research is closely tied to Guardrails design, RLHF robustness, and the study of Hallucination and model reliability more broadly; it informs how Foundation Models are evaluated for safety before deployment. Red-teaming — structured adversarial testing — is now a standard pre-release practice at major AI labs specifically because of jailbreaking.

You will encounter jailbreaking in AI safety research papers, in policy discussions about AI regulation, and in enterprise AI deployment guidelines that specify how models should be tested for robustness before handling sensitive applications.