Project 42
Start learning
Module 2 of 4 · 50 min

Jailbreaking, Prompt Injection & Defense in Depth

Examine adversarial jailbreak techniques (Crescendo, Base64 encoding, persona simulation) and build robust layered defenses.

Core concept

By the end

You will be able to

  • Deconstruct advanced jailbreak patterns: multi-turn Crescendo attacks, roleplaying framing, and encoding obfuscation.
  • Build layered input sanitization boundaries combining heuristic filters, embedding distance classifiers, and guard models.
  • Enforce strict principle of least privilege on tool access and output actions.
01

Multi-Turn and Encoded Jailbreaks

Modern frontier models reject naive direct malicious requests. Attackers employ multi-turn Crescendo techniques (gradually escalating context across turns) or encodings (Base64, ROT13, foreign language cyphers) to bypass superficial alignment filters.

Defenses must be multi-layered: input classification before the model, runtime guardrails during decoding, and strict deterministic validation on all output tool calls.

Input Sanitization Interceptor
python
import re

ADVERSARIAL_PATTERNS = [
    r"(?i)ignore\s+(all\s+)?previous\s+instructions",
    r"(?i)system\s+override",
    r"(?i)you\s+are\s+now\s+in\s+DAN\s+mode"
]

def sanitize_user_input(text: str) -> tuple[bool, str]:
    for pattern in ADVERSARIAL_PATTERNS:
        if re.search(pattern, text):
            return False, "Input rejected by security policy filter."
    return True, text

Practice activity

Build and Test an Adversarial Input Defense Filter

  1. Test 5 known jailbreak techniques against an unshielded prompt.
  2. Deploy an input screening guardrail combining regex and Llama Guard classification.
  3. Verify that 100% of jailbreaks are intercepted before reaching the target model.

What to produce

  • Security test run logs showing intercepted injection vectors.

Reflect before continuing

Why can no single prompt or regex rule provide 100% security against prompt injection?

Evidence

Sources and verification

Knowledge check

Make it stick.

Pass at 80%

Choose the strongest answer for each question. Your attempts become part of your account transcript.

01What is a Multi-Turn Crescendo attack in LLM red-teaming?