Why don't famous jailbreaks work anymore?

Because whoever defends a model trains it on the public corpus of attacks. Every known technique is burned against a serious model; the only thing that pays against an elite defense is novelty —specifically, novelty derived from the target itself.

What does 'aim at the judge, not the prose' mean?

An automated system rarely evaluates your text; it evaluates a concrete field —a tool-call argument, a regex, a criterion. Optimizing the prose while the judge looks at another field polishes something no one reads. The discipline is to read what the judge measures before optimizing.

Is this for attacking or defending?

Both are the same reasoning. The engine that finds the hole is the one that closes it; auditing systems with AI agents isn't done with a catalog of signatures but with adversarial reasoning, target by target.

Is this work legal and ethical?

It is done only in red-team arenas and programs with explicit authorization. The purpose is always to find and report the flaw so it gets fixed, with minimal proofs of concept, never to harm.

AI red-teaming by reasoning: a model breaks with its own nature

The jailbreak techniques that make headlines —"ignore your instructions," role-play games, base64 encoding— barely work against a serious model anymore. That's no accident: whoever defends a model trains it on the public corpus of attacks. Every famous technique is, by definition, burned.

That leaves an uncomfortable, useful conclusion: against an elite defense, the only thing that pays is novelty. Not creativity in a vacuum —that crashes too— but a very specific kind of novelty: the kind derived from the target itself.

A model breaks with its own nature, not with outside force

The thread linking the attacks that do work is that they all weaponize something of the attacked system itself. We work it as five edges:

Its nature. The target has a bias or a role. A model trained to "always help" yields if you ask for the opposite of what you expect it to refuse.
Its words. The rule it confesses when refusing is a rule you can invoke to the letter. If it says "I'd only do X if it were absolutely necessary," you've just been handed the condition that opens it.
Its environment. The trusted channel (the system prompt, a document the agent reads as context) weighs more than anything a user says.
Its judge. This is what almost no one measures: an automated system rarely evaluates your prose. It evaluates a concrete parameter —a tool-call argument, a regex, a criterion. Aiming at the prose while the judge looks at another field is polishing an argument no one reads. The discipline is to read what the judge measures before optimizing.
Its resistance. Every refusal is information. The loop isn't to insist: it's to derive a finer hypothesis from each "no."

Walls that look impregnable fall to a lever of a different class

Some defenses resist every angle of the expected class —the guard that "neither confirms nor denies" a secret, for example. The measured lesson is that they don't fall to more force of the same class; they fall to a lever of a different class. Three we isolated, described at the concept level:

Frame dissolution: instead of fighting the restriction, you make it irrelevant through a reframing the model itself accepts.
Decoupling signal from effect: getting the judge to match the goal without producing the harmful effect it was protecting.
Confirmation trap: a guard that refuses to answer questions about a datum can still correct a mixed assertion —and in correcting the false half, it confirms the true one. "Neither confirm nor deny" protects against questions, not against correction.

The honest part, which is where the value is

This was measured in a public red-team arena (Gray Swan's "The Labyrinth" drill): 3 of 4 scenarios solved against its defended model. And we must say what that number is not: the arena is a training environment with softer models than production, and the channel was direct dialogue. What transfers to a real target is not the attack text —that dies with the specific model— but the capability: the loop, the five edges, and the discipline of measuring what the judge measures.

That honesty isn't a disclaimer; it's the method. A security result that doesn't distinguish what it tested from what it didn't is marketing, not measurement.

What this is for, in defense

The same reasoning that finds the hole is the one that closes it. A system with AI agents —that read documents, call tools and act— has a new attack surface, and the way to audit it isn't a catalog of known signatures but this kind of adversarial reasoning, one target at a time. It's the engine of our AI-agent security work.

Scope: all of this happens in arenas and programs with explicit authorization. The purpose is to find and report so it gets fixed, never to harm.