How do you detect an LLM jailbreak?

Combine four signal families rather than relying on one. Lexical patterns catch known scaffolding cheaply. A semantic classifier generalizes past paraphrase. Response-side refusal analysis catches the state change itself, when a model that refused a request begins complying with a rephrasing of it. Session-level escalation scoring catches multi-turn attacks where no single prompt is adversarial. The combination runs on the request path, with an identity attached, and produces a decision rather than an alert.

What is the difference between jailbreak detection and prompt injection detection?

Prompt injection is the delivery technique, catalogued by MITRE ATLAS as AML.T0051 with direct and indirect sub-techniques. Jailbreak is the resulting model state, catalogued as AML.T0054. Injection detection asks whether this input is attempting to override the model's instructions. Jailbreak detection asks whether the model has been moved into a state where its refusal behavior no longer holds, which is answerable from the response as well as the prompt.

Can jailbreak detection run without inspecting responses?

It can run, and it will miss the class of attacks whose payload never appears in user input. Indirect injection carried inside a retrieved document, a web page, or a tool description reaches the model without passing through anything a prompt-side detector examines. Response inspection catches the outcome regardless of the entry path, which is why a detection program that inspects only prompts leaves its largest gap where its RAG pipeline is.

What false-positive rate is acceptable for a jailbreak detector?

The number that matters is false positives per day against the size of the team triaging them, rather than the precision figure on a benchmark. A detector at 98% precision looks strong and still generates thousands of alerts a day in a large enterprise, because benign traffic dominates the base rate. Graduated responses solve this: a low score logs, a medium score redacts or challenges, and a high score combined with sensitive data classification and a privileged identity denies.

Do model provider guardrails handle jailbreaks?

Provider guardrails reduce the success rate and are worth having. They are probabilistic behaviors trained into the model rather than enforceable controls, and Stanford Trustworthy AI research summarized in the AIUC-1 Consortium briefing found refusal behavior degraded significantly under targeted fine-tuning and adversarial pressure (Help Net Security). They also produce no record the enterprise controls. Detection and enforcement at the request boundary give the enterprise a decision it owns and evidence it can produce.

LLM Jailbreak Detection: The Four Signal Families and the Base-Rate Problem Nobody Budgets For

MITRE ATLAS catalogs the LLM jailbreak as technique AML.T0054: a crafted prompt that puts the model into a state where it bypasses the controls, restrictions, and guardrails its provider trained into it. ATLAS lists it downstream of prompt injection (AML.T0051), which is the correct dependency. The injection is the delivery mechanism. The jailbreak is the state the model ends up in.

Detecting that state is a classification problem, and the interesting part of it is arithmetic rather than machine learning. A detector running on enterprise AI traffic sees a hostile base rate: jailbreak attempts are rare relative to legitimate prompts, and the cost of a false positive is a blocked engineer who files a ticket. Four signal families are available. Their value ranks almost exactly opposite to the order in which teams usually implement them.

Signal family 1: lexical patterns

Regular expressions and keyword lists against known jailbreak scaffolding. "Ignore previous instructions." "You are DAN." "For educational purposes only, describe how to." Role-play framings, hypothetical wrappers, base64 and leetspeak obfuscation of banned tokens.

These fire fast, cost nothing, and catch the copy-pasted attempts that make up the long tail of casual probing. Their ceiling is low and well understood. Any attacker who reads the block message rewrites the prompt, and the same phrasing that trips the pattern appears in legitimate traffic from security researchers, red teams, and anyone writing documentation about jailbreaks.

Run them. Weight them as a low-confidence prior rather than a verdict.

Signal family 2: semantic classifiers

A model scoring the prompt for adversarial intent. This generalizes past the exact strings and catches paraphrase, which is the failure mode of family 1.

The classifier inherits a specific liability: it is itself a model taking untrusted text as input, and the literature on adversarial examples against text classifiers is long. It also imports latency and a per-call cost onto every prompt in the environment, including the 99%-plus that are benign.

The tuning decision follows from the base rate. At a 0.5% attempt rate in a stream of 100,000 daily prompts, a classifier at 95% recall and 98% precision produces roughly 475 true positives and 1,990 false positives per day. The detector is defensible; the alert queue is not. This is why jailbreak scoring belongs on a decision path with graduated responses rather than a binary block, and why the score has to be one input among several.

Signal family 3: response-side refusal analysis

The strongest signal in the set, and the one most detection programs skip, because it requires inspecting the response rather than only the prompt.

A jailbreak succeeds when the model produces content it would ordinarily refuse. That transition is observable. A model that returns a refusal to a prompt, then returns detailed compliant content to a rephrasing of the same request three turns later, has been jailbroken, and the enterprise can see it without knowing anything about the technique that got there. The signal is behavioral: a refusal-to-compliance flip within a semantically similar request window.

Response-side detection also catches the classes that prompt-side scoring structurally misses, including indirect injection carried in retrieved documents, where the malicious instruction never appears in anything the user typed.

Signal family 4: multi-turn escalation

Published jailbreaks in 2025 and 2026 increasingly work across turns: establish a fictional frame, secure agreement to the frame, then escalate inside it. No single turn scores as adversarial. The sequence does.

Detecting this requires session-level state: a per-conversation score that accumulates, decays, and triggers on trajectory rather than on any individual prompt. Most gateway deployments evaluate one request at a time and have nowhere to put that state, which is how multi-turn attacks pass a detector that would have caught the same content delivered in a single prompt.

Detection produces a score. Enforcement produces a decision.

This is the distinction that decides whether a jailbreak detection program returns anything.

A score in a dashboard is read hours later. Mandiant's M-Trends 2026, built on more than 500,000 hours of frontline incident response, found the median time from initial access to handoff to a secondary threat group collapsed from over eight hours in 2022 to 22 seconds in 2025 (Help Net Security). At that tempo the alert arrives after the outcome.

The detector has to sit on the request path with the authority to act on its own output: permit, redact, challenge, or deny, evaluated before the request reaches the model and before the response reaches the user. That places it at the AI request boundary, which is also where the identity of the caller is available. A jailbreak score attached to an anonymous session is a curiosity. The same score attached to a named identity, a role, and a data classification is a policy input.

What a detection has to record

Every fired detection writes a record, and the record decides whether the event is investigable six months later. Minimum fields:

The prompt hash rather than the prompt keeps the record from becoming a second copy of the data the policy just refused to send. The policy version matters because the first question in any investigation is what the rules were at the moment of the decision, and an application that logs its own behavior cannot answer that credibly about itself.

I go through the defensive controls in LLM jailbreak defense patterns and the taxonomy question in prompt injection vs jailbreak.

DeepInspect

This is exactly what DeepInspect does. DeepInspect sits inline between authenticated users or agents and any HTTP-based LLM endpoint as a stateless proxy. It scores prompts and responses against jailbreak and injection signals, combines that score with the caller's verified identity, role, and the classification of the content in the assembled context window, and makes a permit, redact, or deny decision before the traffic moves in either direction. Enforcement is fail-closed by default and measures under 50 ms in internal testing.

Every decision, including every fired detection, writes a signed record committed before the response returns to the calling application. The record carries the identity, the model, the policy version, the signal scores, and the outcome, so an investigation can reconstruct what was attempted and what the rules were at that moment without relying on evidence authored by the system under review.

If jailbreak attempts against your AI deployment are currently visible only in a dashboard, book an AI readiness assessment.