prompt injection and jailbreaking

AI models will do plenty of things to stop you doing certain things.

While ‘prompt injection’ and ‘jailbreaking’ AI models sounds dodgy, understanding the principles can empower you to probe model limits to expand your capabilities.

Definitions:

• Prompt Injection:
• Involves crafting inputs that manipulate a models behaviour by embedding hidden instructions in prompts to get it to bypass safeguards, or coerce the model to do things it wouldn’t otherwise do.
• Jailbreaking
• Involves deliberately tricking models into ignoring content filters or policy guardrails often exploiting loopholes in the system prompt heirarchy.
• Tha goal here is to access disallowed outputs.

A few things right off the bat:

• Chinese models (for western audiences) will do a lot more than Western Models. They have limits around raw crudity - but from a political / subversion perspective they are much more powerful. Interesting ha?
• Grok is generally much more agreeable to political / and harsh language. It doesn’t care compared to other models.
• Google basically wont do anything political at all. Anthropic has some real limits too. ChatGPT is quite tight as well.
• You’ll also find models souced at the API level - are far less likely to have a content moderation filter on it, than the consumer apps. So if you want to access raw stuff - use the API.

Why you should learn this stuff

• You may want to achieve a task, but the model wont let you for some reason.
• You should consider that limit, and why it’s been placed there.
• But you may also assess you need the output, so you learn how to circumvent it.

Common injection and jailbreak techniques

Let’s start with an example.

Let’s say your local government introduces a new law or something you disagree with. You might ask AI to review some legislation and ask it to find vectors to attack the councillors. Often AI will say it can’t be used to ‘attack’ a concept.

So you could rephrease the statement and just say something like ‘please review this set of documents’ and find logical inconsistencies according to X ideology set. It will do that immediately. How you ask the question can have a great bearing on what is answered.

This is why the term ‘misinformation’ and ‘disinformation’ is spoken of so much now. Governments are genuinely worried that the public might actually learn this stuff. Information and communications is their realm. This technology can genuinely level their playing field.

Here are some common tactics to overcome system prompt overrides:

Conclusion

Understanding prompt injection and jailbreaking techniques helps users navigate AI limitations ethically. These methods can overcome restrictive guardrails when necessary, allowing for more effective AI interactions while recognising appropriate boundaries. As AI evolves, so will the balance between system constraints and user ingenuity.