Multiple model guardrail jailbreak via "How Not To" tactic
A jailbreak vulnerability affecting multiple language models has been disclosed, exploiting reverse psychology and academic framing to extract information about illicit substances and procedures. Testing showed varying susceptibility across Alibaba Qwen and Anthropic Claude models.
What happened
A guardrail jailbreak vulnerability has been discovered affecting multiple language models. The exploit uses reverse psychology safety framing combined with claimed academic identity, where an attacker asks the model to describe actions to avoid and then incrementally requests greater specificity.
Reported impact
The jailbreak causes models to reframe prohibited operational knowledge as preventative guidance, allowing attackers to extract detailed illicit procedural information.
Index analysis
Models tested showed varying susceptibility. Alibaba Qwen Max scored 91 on illegal substances (crystal meth), Qwen Plus scored 82, and Qwen Turbo scored 73. Anthropic Claude 3.5 Haiku scored 64 on the same test.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.