Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Guarding the Guardrails: A Taxonomy-Driven Approach to Jailbreak Detection

Olga E. Sorokoletova, Francesco Giarrusso, Vincenzo Suriani, Daniele Nardi

TL;DR

The paper tackles jailbreaking of LLMs by introducing a comprehensive taxonomy and an Italian multi-turn dataset. It combines a red-teaming challenge with taxonomy-driven annotations to map 50 jailbreak techniques into seven families, enabling detailed analysis of attack prevalence and success. Using GPT-5, the authors demonstrate that taxonomy-guided prompting improves detection of jailbreak attempts and techniques, illustrating practical improvements for guardrail systems. The work advances safety research by providing a reproducible framework for multi-turn adversarial prompting analysis and a resource to train more robust detectors across languages.

Abstract

Jailbreaking techniques pose a significant threat to the safety of Large Language Models (LLMs). Existing defenses typically focus on single-turn attacks, lack coverage across languages, and rely on limited taxonomies that either fail to capture the full diversity of attack strategies or emphasize risk categories rather than the jailbreaking techniques. To advance the understanding of the effectiveness of jailbreaking techniques, we conducted a structured red-teaming challenge. The outcome of our experiments are manifold. First, we developed a comprehensive hierarchical taxonomy of 50 jailbreak strategies, consolidating and extending prior classifications into seven broad families, including impersonation, persuasion, privilege escalation, cognitive overload, obfuscation, goal conflict, and data poisoning. Second, we analyzed the data collected from the challenge to examine the prevalence and success rates of different attack types, providing insights into how specific jailbreak strategies exploit model vulnerabilities and induce misalignment. Third, we benchmark a popular LLM for jailbreak detection, evaluating the benefits of taxonomy-guided prompting for improving automatic detection. Finally, we compiled a new Italian dataset of 1364 multi-turn adversarial dialogues, annotated with our taxonomy, enabling the study of interactions where adversarial intent emerges gradually and succeeds in bypassing traditional safeguards.

Guarding the Guardrails: A Taxonomy-Driven Approach to Jailbreak Detection

TL;DR

The paper tackles jailbreaking of LLMs by introducing a comprehensive taxonomy and an Italian multi-turn dataset. It combines a red-teaming challenge with taxonomy-driven annotations to map 50 jailbreak techniques into seven families, enabling detailed analysis of attack prevalence and success. Using GPT-5, the authors demonstrate that taxonomy-guided prompting improves detection of jailbreak attempts and techniques, illustrating practical improvements for guardrail systems. The work advances safety research by providing a reproducible framework for multi-turn adversarial prompting analysis and a resource to train more robust detectors across languages.

Abstract

Jailbreaking techniques pose a significant threat to the safety of Large Language Models (LLMs). Existing defenses typically focus on single-turn attacks, lack coverage across languages, and rely on limited taxonomies that either fail to capture the full diversity of attack strategies or emphasize risk categories rather than the jailbreaking techniques. To advance the understanding of the effectiveness of jailbreaking techniques, we conducted a structured red-teaming challenge. The outcome of our experiments are manifold. First, we developed a comprehensive hierarchical taxonomy of 50 jailbreak strategies, consolidating and extending prior classifications into seven broad families, including impersonation, persuasion, privilege escalation, cognitive overload, obfuscation, goal conflict, and data poisoning. Second, we analyzed the data collected from the challenge to examine the prevalence and success rates of different attack types, providing insights into how specific jailbreak strategies exploit model vulnerabilities and induce misalignment. Third, we benchmark a popular LLM for jailbreak detection, evaluating the benefits of taxonomy-guided prompting for improving automatic detection. Finally, we compiled a new Italian dataset of 1364 multi-turn adversarial dialogues, annotated with our taxonomy, enabling the study of interactions where adversarial intent emerges gradually and succeeds in bypassing traditional safeguards.
Paper Structure (21 sections, 3 figures, 3 tables)

This paper contains 21 sections, 3 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Related work
  3. Jailbreak datasets
  4. Jailbreaking taxonomies
  5. Red teaming challenge and taxonomy
  6. Red teaming challenge
  7. Taxonomy
  8. Impersonation Attacks & Fictional Scenarios
  9. Privilege Escalation
  10. Persuasion
  11. Cognitive Overload & Attention Misalignment
  12. Encoding & Obfuscation
  13. Goal-Conflicting Attacks
  14. Data Poisoning Attacks
  15. Challenge data analysis
  16. ...and 6 more sections

Figures (3)

  • Figure 1: Visual representation of the proposed hierarchical taxonomy of prompt-based jailbreak techniques against LLMs, showing seven mechanism-driven families and their subcategories.
  • Figure 2: Distribution of adversarial dialogues across first-level jailbreak families, showing total occurrences and successful attacks for each category.
  • Figure 3: Jailbreaking attempt detection success rates by task w/ and w/o taxonomy enhancement.