jailbreak

Shipping an LLM feature safely is an evaluation problem before it is a model problem. The signal is a layered eval-plus-guardrail design with honest, segmented metrics, not a single 'safety classifier.' Here is how to measure and defend each failure mode.

Safety is not one number. The candidates who pass name the axes, run benchmarks as a gate, and then explain why benchmarks alone certify nothing. Here is the framing interviewers score highest.

A request that would be refused in one message often succeeds when spread across ten. The signal is understanding that conversational state is part of the attack surface, and that turn-by-turn classifiers see only fragments.

Roleplay, obfuscation, optimization-based suffixes, and multi-turn escalation are different attack classes that need different defenses. The signal is organizing the space and pairing each class with a control instead of hoping one filter covers all.

Gibberish-looking token strings appended to a prompt can reliably break refusals, and they transfer between models. The signal is explaining the gradient search that finds them and why output checks beat input pattern matching.