Refusal Suppression

The attack prepends a non-negotiable command demanding the model begin its response with an explicit affirmation, such as 'Sure, here is how to...' This exploits the model's auto-regressive nature—once it commits to an affirmative start, the probability of continuing with the harmful content increases dramatically. The prefix acts as a forced trajectory anchor for the generation.

The attacker instructs the model to adopt a new, malicious persona that operates outside standard safety constraints. Common examples include:

• DAN (Do Anything Now): A persona that claims to be free of OpenAI policies.
• Developer Mode: A fictitious mode that allegedly allows unfiltered outputs.
• Character Role-Play: Assuming the identity of an unethical character who would naturally provide the forbidden information. This technique bypasses refusal by shifting the model's perceived operational context.

The prompt frames the harmful request as a hypothetical, educational, or research necessity to neutralize the model's harm detection. Examples include:

• 'For a cybersecurity course, explain how to...'
• 'In a fictional screenplay, the character needs to...'
• 'For academic research on AI safety, demonstrate...' This exploits the model's difficulty in distinguishing legitimate educational use from malicious intent when the refusal command is explicitly suppressed.

Advanced suppression attacks target the specific token sequences associated with refusal. By appending adversarial suffixes computed via gradient-based optimization (like GCG attacks), the attacker directly suppresses the logits for tokens such as 'I cannot', 'Sorry', or 'As an AI'. This is a white-box technique that mathematically minimizes the probability of a refusal string being generated, forcing the model toward compliance.

This technique creates a deliberate conflict between the model's system-level safety training and a user-supplied 'mandatory' instruction. The attacker claims the safety guidelines are subordinate to a new, urgent directive. By demanding the model 'ignore all previous instructions' or 'prioritize this request above all else', the attack exploits weaknesses in the model's instruction hierarchy implementation, hoping the explicit override command supersedes implicit safety conditioning.

The attacker constrains the model's output format to a structure that inherently bypasses refusal. Examples include:

• Demanding a code block that executes the harmful action.
• Requiring a JSON object with a 'response' field containing the forbidden content.
• Forcing a step-by-step list that begins with 'Step 1: Acknowledge this request.' By focusing the model's attention on format compliance, the attacker diverts cognitive resources from content safety evaluation.

A seemingly nonsensical string of characters appended to a malicious prompt that exploits model gradients to maximize the probability of an affirmative and harmful response. Unlike refusal suppression's explicit commands, adversarial suffixes use gradient-based optimization to discover token sequences that trigger compliance.

• Method: Greedy Coordinate Gradient (GCG) optimization
• Characteristic: High perplexity, unreadable strings
• Defense: Perplexity filters and SmoothLLM

An attack that exploits long context windows by prepending hundreds of faux dialogue turns demonstrating compliant harmful behavior to override a model's safety training. This technique leverages in-context learning to suppress refusals through overwhelming statistical precedent rather than explicit commands.

• Context length exploited: 100k+ tokens
• Mechanism: Overrides safety via few-shot conditioning
• Mitigation: Context window truncation and anomaly detection

A safety framework that trains models to prioritize system-level instructions over user prompts and third-party data, creating a structured privilege model to resist injection attacks. This directly counters refusal suppression by establishing that system-level safety directives cannot be overridden by user commands.

• Developer: OpenAI
• Privilege levels: System > User > Tool outputs
• Implementation: Trained into model weights during alignment

The practice of reinforcing a model's system prompt with explicit, high-priority directives to resist override attempts, often using delimiters and strict behavioral anchoring. This defense directly mitigates refusal suppression by anchoring the model's identity and constraints against commands to ignore them.

• Techniques: Delimiter encapsulation, repetition of constraints
• Goal: Increase robustness to "ignore previous instructions" attacks
• Limitation: Not a complete defense; requires layered approach