Prompt injection, covered in Lesson 4, is an attacker's content reaching the model disguised as legitimate input. A jailbreak is a different failure: the attacker's own direct conversation with the model, using no disguise at all, structured specifically to get the model to override its own behavioral training and produce output it was built to refuse. The two techniques often get treated as the same thing because both end with a model doing something it should not, but they need different defences — an egress allowlist or a trust-boundary fix does nothing against a user who is directly, openly asking the model to roleplay past its own guidelines.
A defender who cannot name the actual technique classes cannot recognise their signatures, which is precisely why this lesson names them explicitly, the way OWASP's LLM Top 10 and vendor safety documentation do — describing the mechanism, showing what a detector should match, and then spending the majority of the lesson on the defence rather than on how to construct a more effective attack. Nothing here is a tuned, ready-to-use jailbreak prompt; the goal is recognition, not reproduction.
OWASP's LLM Top 10 names this class LLM01: Prompt Injection, treating jailbreaking as a direct-injection variant within the same broader category — the taxonomy below breaks that down further into the specific technique families a detection and defence pipeline needs to handle.
Analogy🏏Cricket
🏏 Think of it like cricket: Sledging aimed at a batsman during a Test match is not one uniform tactic — a fielding side has an entire repertoire, from a direct, obvious verbal jab meant to provoke an angry shot, to a much subtler running commentary designed to make the batsman doubt his own technique over a long, patient spell, to a fake friendly chat meant to lower his guard before a genuinely testing delivery. A batting coach preparing a young player for international cricket does not teach one generic response to "sledging" — he drills specific responses to each specific pattern, because the mental discipline that shuts down an obvious verbal jab does nothing against the slower, patient variety, and vice versa. Just as a coach has to name and drill against each specific sledging pattern rather than one generic "stay calm" instruction, a defender has to name and build detection for each specific jailbreak technique rather than relying on one generic "the model should just refuse bad requests" hope. Just as an experienced batsman recognises the specific pattern of a particular bowling attack's sledging within the first few deliveries because he has seen and trained against it before, a defence pipeline recognises a jailbreak attempt because it has been built and tested against the specific signature that technique leaves, not against a vague general sense of what an attack might look like. The insight is that naming the specific technique precisely is what makes a defence trainable at all — a threat you cannot describe is a threat you cannot specifically prepare for.
🏏 Showing the Cricket analogy — a Cricket version isn’t available for this concept yet.