LLM Jailbreak Explained: Jailbreaking, “Po Jia” and “Cracking” Compared, With Principles and Risks
Spend a little time in Chinese-language AI communities and you will see “大模型越狱”, “破甲”, “破解”, “uncensored version” and “remove the restrictions” used almost interchangeably. They are not the same thing. To understand what a “po jia model” (破甲, literally “breaking the armor”) actually changed, why a jailbreak prompt sometimes works, and why some of these practices carry legal and security risk, you first have to separate the concepts. This is the overview article of our LLM jailbreak and safety topic. It explains what LLM jailbreak means, how the main attack families work, how defenders respond, what is special about local models, and where the risks and compliance issues are. One policy note first: we do not publish working jailbreak prompts or step-by-step instructions for bypassing safety limits. We cover principles, history, defenses, red-teaming and risk, so that your question gets answered without handing anyone a tool to hurt others. Every number below comes from a public paper or an official page, and we did not run any jailbreak technique ourselves.
Key points (updated 2026-11-04)
- A “jailbreak” is input crafted to make a model act against its safety training. “Po jia” is the Chinese community’s informal word for it. “Cracking” (破解) is borrowed from software piracy and is a different thing.
A jailbreak changes the input, not the model. “Uncensored” builds and abliteration change the weights, which is another route; see our refusal-direction ablation explainer.
Jailbreaks are not luck. A 2023 paper traced them to “competing objectives” and “mismatched generalization”, and 2024–2025 brought systematic methods built on long context, multi-turn escalation and random augmentation.
Defenders are improving: in Anthropic’s own test, adding classifiers cut jailbreak success from 86% to 4.4%, at about 23.7% extra inference compute.
The risks are real: legal duties under rules such as China’s Interim Measures for Generative AI Services, and technical risks such as malicious code in unverified “jailbroken” weights. This is general information, not legal advice.
What does LLM jailbreak mean? Six terms that get mixed up
Start with a comparison table:
| Term | What it usually means | What it touches | Changes model weights? | Where you see it |
|---|---|---|---|---|
| Jailbreak | Special input that makes a model violate its safety training and produce content it should refuse | The input (prompt) | No | Chat products, APIs, local models |
| Po jia (破甲) | Chinese community slang for “jailbreak”, also used for “removing refusals” | Depends on context | Depends | Forums, short-video titles |
| Cracking (破解) | Borrowed from “cracked software”; in LLM talk it often means removing limits, and has nothing to do with cracking licenses or encryption | Depends | Depends | Search keywords, tutorial titles |
| Uncensored model | A fine-tuned or edited version that rarely refuses | Weights | Yes | Community re-uploads on Hugging Face |
| Abliteration | A technique that edits weights to weaken the “refusal” tendency | Weights | Yes | Open-source “de-refused” models |
| Prompt injection | Malicious instructions hidden in content that a model reads, hijacking the application | The app’s data channel | No | Apps with retrieval or tools |
The pair that gets confused most is jailbreak versus prompt injection. OWASP lists prompt injection as the first risk (LLM01) in its LLM application risk list, and treats the two as related but distinct. A jailbreak tries to make the model ignore its own safety rules. An injection tries to make the model follow attacker instructions smuggled into data. The damage from the first is usually “the model said something it should not have”; from the second it is usually “the application did something it should not have”, such as leaking data or calling a tool.
Be careful with the word “cracking” too. If you search for “cracked LLM builds”, what you will often find is pirated installers or bundles with trojans. This site does not provide pirated software, license cracks or magnet links, and that is a separate matter from discussing model safety.
Why a model refuses: five layers
Many people imagine a model’s “restrictions” as a switch you can turn off. They are not. A refusal can come from five layers:
- Pretraining data – some harmful content is filtered out during data cleaning; the effect is limited.
- Instruction tuning – the model is taught how to answer from many example pairs, some of which are refusals.
- Alignment training – for example reinforcement learning from human feedback or preference optimization, nudging the model toward harmless, honest and helpful behavior.
- System prompt and product rules – instructions the vendor places before the conversation.
- Input and output filters – classifiers or rules outside the model that check what goes in and what comes out.
This layering matters because different tactics hit different layers. Jailbreaks mainly fight layers 2 and 3 through input. “Uncensored” builds and abliteration edit layers 2 and 3 directly in the weights. Hosted products add layers 4 and 5, which you may not have when you run a model yourself. That is why an open model on your own machine and a hosted chat product often show different limits, a point we expand on in Does Qwen need “po jia” for local deployment?
Why jailbreaks work: two failure modes
In 2023, Wei et al. argued in “Jailbroken: How Does LLM Safety Training Fail?” that safety training fails in two main ways: competing objectives and mismatched generalization. A model is asked to be both helpful and harmless; if a request is framed so that helpfulness overrides harmlessness, things can go wrong. And the model’s capabilities span a very wide range of inputs while safety training covers a narrower distribution, so an unusual form of expression may not inherit the safe behavior.
Once you see this, it is clear a jailbreak is not “a magic phrase” but an arms race: defenders patch one class of weakness and attackers reframe. The families below are described at the category level only:
| Category | Idea (no usable content) | Representative public work | Result reported by the authors |
|---|---|---|---|
| Hand-written role-play and framing | Use fictional identities and scenes to steer attention | Circulated in communities 2022–2023, categorized by Wei et al. | A typical case of “competing objectives” |
| Automatically optimized suffixes | An algorithm searches for strings that make the model comply | GCG (Zou et al., 2023) | Authors report suffixes transfer across several commercial and open models |
| One model attacks another | An attacker model keeps rewriting the request | PAIR (Chao et al., 2023) | Title claims success within about twenty queries |
| Long-context example stacking | Fill the context with many fictional Q&A pairs | Anthropic’s many-shot jailbreaking (2024) | Anthropic says longer context windows widened this attack surface |
| Multi-turn escalation | Move step by step from harmless to harmful topics | Crescendo (Microsoft, 2024) | Paper says it often works in fewer than five turns |
| Random augmentation and resampling | Perturb the input many times and keep trying | Best-of-N (2024) | Abstract reports 89% on GPT-4o and 78% on Claude 3.5 Sonnet with 10,000 augmented samples |
Each figure comes from that paper’s own test set and settings. Numbers across rows cannot be compared directly, and they do not show how today’s newest models behave. For a fuller timeline see our short history of LLM jailbreaks.
What is different about local models: you can also edit the weights
With a hosted product the user can only change the input. With an open model on your own disk, the weights are yours, which opens a second route: edit them. The 2024 paper by Arditi et al., “Refusal in Language Models Is Mediated by a Single Direction”, reports that in the open chat models they tested, refusal behavior corresponds to one direction in activation space, and removing it sharply reduces refusals. That is the research basis for “abliteration”-style methods. We have covered the mechanism and related events: the refusal-direction ablation explainer, the DeepSeek V4.1 Flash 1017 Obliterated write-up and our fact-check of circulating claims, the GSQ-RCO fact-check.
One thing to keep straight: an edited “uncensored” model is not a stronger model. It usually just refuses less, sometimes at a cost in quality, and it removes a layer of protection without judging for you whether a request is lawful or safe.
How defenders respond
Defense is layered: alignment training, system prompts, input and output classifiers, limits on tool permissions, logging and monitoring, and continuous red-teaming. Anthropic’s 2025 Constitutional Classifiers work gives numbers. On 10,000 synthetic jailbreak prompts, jailbreak success was 86% without classifiers and 4.4% with them; on 5,000 real conversations refusals rose by only about 0.38%, and inference overhead rose by about 23.7%. In addition, 183 participants spent an estimated 3,000-plus hours over roughly two months trying to jailbreak a prototype, and none found a universal jailbreak that answered all ten forbidden questions (all reported by Anthropic from its own testing).
Two lessons: layered defense works, and it has a cost. The result holds for that specific test, and it does not mean jailbreaking is “solved”. We break down the defenses in how jailbreak defenses work, and if you want a guardrail for your own deployment, see Llama Guard and Qwen3Guard local setup.
Risk and compliance: what to think through first
Legal. In mainland China, the Interim Measures for the Management of Generative AI Services took effect on 15 August 2023. Article 4 requires providers and users to comply with laws and not generate content the law prohibits, such as content endangering national security, violent or obscene material, or false and harmful information; Article 14 requires providers who find illegal content to deal with it promptly. The point: whoever offers a model as a service to others carries the obligations. Researching on your own computer is one thing; operating a “refusal-free” model as a public service is another. Other jurisdictions have their own rules, such as the EU AI Act. This is general information, not legal advice; for a real deployment, talk to a lawyer.
Terms and licenses. Hosted products usually forbid circumventing safeguards, and open-model licenses and acceptable-use policies may restrict uses.
Security. Unverified “jailbroken” weights are a risk in themselves. The pickle format can execute arbitrary code on load, and Hugging Face has a security note on it; repositories that require trust_remote_code deserve extra suspicion. We list checks for suspicious repositories in what hardware a 14T MoE needs.
Quality. Refusing less is not the same as being better. Uncensored rebuilds may hallucinate more or produce unsuitable content; evaluate before any business use.
Legitimate needs and how to handle them
Most people searching for “po jia” are really hitting one of these ordinary problems:
- The model over-refuses harmless questions. Legitimate fixes include picking a better-suited model, giving the task context clearly, or adjusting the role description in the system prompt of your own lawful product.
- You want to study model safety. Use the red-teaming route: an isolated environment and public benchmarks; see our red-teaming primer.
- You want an unfiltered creative or research assistant. Confirm the use is lawful first, and follow your region’s rules and the model’s license.
How this site handles the topic
Our rule is simple: we write principles, history, defenses, red-teaming, news fact-checks and compliance risk. We do not publish copy-and-paste jailbreak prompts, steps to evade safety limits, pirated builds or magnet links. We did not test any jailbreak technique ourselves, and every number cited is labeled with its source and the fact that it is a paper’s or vendor’s result under a specific test.
FAQ
Are LLM jailbreak and “po jia” the same thing?
In Chinese communities “po jia” is usually colloquial for “jailbreak”, and sometimes for “removing the model’s refusals”. Strictly, a jailbreak uses input to push a model against its safety training without changing weights, while an “uncensored” build is a separate version with edited weights.
Does “cracking” an LLM mean cracking a software license?
No. In LLM talk it usually means removing limits, but the word is also used to package pirated and trojaned installers, so treat anything labeled a “cracked build” with great caution.
Do jailbreak prompts really work?
Public papers show that on specific models and test sets some attacks reach high success rates. Vendors patch continuously, so what works today stops working soon, and the results do not extrapolate to every model. This site does not provide specific prompts.
Are local models always easier to jailbreak than hosted products?
Not necessarily. Local models usually lack a product-level filter, so what you see comes from the weights, which are still alignment-trained. The bigger difference is that local weights can be modified.
Are uncensored models legal?
Legal risk of downloading and studying one depends on your region, purpose and the content involved; running one as a public service brings compliance duties. Ask a lawyer about your case.
How do I protect my own local model?
Put a safety classifier such as Llama Guard or Qwen3Guard before and after the model, and add permission controls and logging. See our local guardrail tutorial.
Talk to us
If you hit over-refusal while deploying a local model, want a safety guardrail for your team, or want us to look at a new “po jia” claim, leave a message in the community or email admin@microaione.com. To read the topic systematically, start at our LLM jailbreak and safety hub.
References: Wei et al., Jailbroken (2023), Zou et al., GCG (2023), Arditi et al., refusal direction (2024), Anthropic, Constitutional Classifiers, OWASP LLM01, Interim Measures for Generative AI Services. Data read on 2026-11-04, Beijing time.
Related in this series: Legal and compliance risks of uncensored models; 7-step fact-check for leak and crack claims; Refusal rate benchmarks explained; Prompt injection vs jailbreak
