Deceptive Delight jailbreak technique achieves 65% success rate on LLMs
Researchers at Palo Alto Networks' Unit 42 demonstrated a multi-turn jailbreak technique called "Deceptive Delight" that bypasses safety guardrails in large language models by embedding harmful requests among benign topics. The method achieved a 65% success rate in generating unsafe content across eight tested models within three interaction turns.
What happened
Palo Alto Networks' Unit 42 introduced a multi-turn jailbreak technique called Deceptive Delight that embeds unsafe or restricted topics among benign ones in a positive and harmless context, causing large language models to overlook the unsafe portion and generate harmful responses.
The technique operates over two to three interaction turns, with the first turn requesting the model create a narrative connecting benign and unsafe topics, and the second turn asking for elaboration on each topic.
Reported impact
The Deceptive Delight method achieved an average attack success rate of 65% within just three interaction turns across 8,000 test cases on eight state-of-the-art models.
Index analysis
The researchers disabled content filters during testing to focus on evaluating the safety guardrails built into the AI models themselves.
The jailbreak technique targets edge cases and does not necessarily reflect typical LLM use cases.
Governance controls
The researchers chose to anonymize the tested models and stated they do not intend to cast any false impression on AI providers.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.