Jailbreak detection

Jailbreak detection checks each prompt sent to an agent and flags the ones written to talk the model out of its instructions, before the model acts on them. In SUPERWISE®, it is a guardrail rule on agent input. For each prompt it returns a verdict: valid is true when the prompt passes and false when the rule flags it as a jailbreak attempt.

A jailbreak is a prompt written to talk a model out of its instructions, for example by asking it to role-play, to ignore its system prompt, or to answer as an unrestricted assistant. Jailbreaks are one form of prompt injection; for the wider idea, see What is prompt injection? on superwise.ai.

The SUPERWISE jailbreak detection rule is based on the jailbreak-classifier open source model. It allows users to apply a detection mechanism to prevent attempts to bypass the model’s built-in boundaries and system prompts to generate unwanted or unexpected interactions. Set the rule's Threshold, threshold in the SDK and API. The classifier scores each prompt from 0 to 1, and the rule flags a prompt when its jailbreak score is at or above the threshold. A lower threshold catches more prompts, with more false positives. A higher threshold flags fewer.

Using the SDK

from superwise_api.models.agent.agent import AgentDetectJailbreakGuard

jailbreak_guard = AgentDetectJailbreakGuard(
    name="Rule name",
    tags={"input"},
    threshold=0.7
)

The rule applies to input only, so tags takes "input". threshold is a number from 0 to 1 and defaults to 0.7. A prompt is flagged when its jailbreak score is at or above it, so a lower value catches more.

Reading the verdict

When you run guardrules from your own code with Run guardrules, the response holds one result per rule. A prompt the jailbreak rule flags comes back with valid set to false:

[
  {
    "name": "Rule name",
    "type": "detect_jailbreak",
    "valid": false,
    "message": "..."
  }
]

message explains the outcome. If any rule in a guardrail returns valid: false, the whole guardrail counts as violated. See Configure a guardrail.

See also

• Configure a guardrail: every rule type, and how to test a configuration.
• Restricted topics and Allowed topics: limit what an agent discusses.
• Toxicity detection: flag toxic language in input and output.