{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2023:P2T42GVWWJOHQJJAWSC3TWPDMC","short_pith_number":"pith:P2T42GVW","schema_version":"1.0","canonical_sha256":"7ea7cd1ab6b25c782520b485b9d9e360b016990f4de50040de30ebdb337f5c9f","source":{"kind":"arxiv","id":"2305.13860","version":2},"attestation_state":"computed","paper":{"title":"Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study","license":"http://creativecommons.org/licenses/by/4.0/","headline":"Jailbreak prompts classified into ten patterns can consistently evade ChatGPT's content restrictions in 40 use-case scenarios.","cross_cats":["cs.AI","cs.CL"],"primary_cat":"cs.SE","authors_text":"Gelei Deng, Kailong Wang, Lida Zhao, Tianwei Zhang, Yang Liu, Yaowen Zheng, Yi Liu, Ying Zhang, Yuekang Li, Zhengzi Xu","submitted_at":"2023-05-23T09:33:38Z","abstract_excerpt":"Large Language Models (LLMs), like ChatGPT, have demonstrated vast potential but also introduce challenges related to content constraints and potential misuse. Our study investigates three key research questions: (1) the number of different prompt types that can jailbreak LLMs, (2) the effectiveness of jailbreak prompts in circumventing LLM constraints, and (3) the resilience of ChatGPT against these jailbreak prompts. Initially, we develop a classification model to analyze the distribution of existing prompts, identifying ten distinct patterns and three categories of jailbreak prompts. Subseq"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":true,"formal_links_present":true},"canonical_record":{"source":{"id":"2305.13860","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2023-05-23T09:33:38Z","cross_cats_sorted":["cs.AI","cs.CL"],"title_canon_sha256":"67ebef0ec3638c8906e0b8c2aec6b55a6889eace3355560ae24ca2a601f93717","abstract_canon_sha256":"5439c127d3c241f075a3a9d933a6d16876d187513c9bfe344027f677c6311ccf"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-17T23:38:46.358980Z","signature_b64":"wxvFGOYFKSBF8Wrfl3tcT37e8psrKmmfVH/ogPN1vKJ8Z2nRSxWrzvYYtpCSCDGsP3rEzwq92A7CEeVeDIpzAA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"7ea7cd1ab6b25c782520b485b9d9e360b016990f4de50040de30ebdb337f5c9f","last_reissued_at":"2026-05-17T23:38:46.358544Z","signature_status":"signed_v1","first_computed_at":"2026-05-17T23:38:46.358544Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study","license":"http://creativecommons.org/licenses/by/4.0/","headline":"Jailbreak prompts classified into ten patterns can consistently evade ChatGPT's content restrictions in 40 use-case scenarios.","cross_cats":["cs.AI","cs.CL"],"primary_cat":"cs.SE","authors_text":"Gelei Deng, Kailong Wang, Lida Zhao, Tianwei Zhang, Yang Liu, Yaowen Zheng, Yi Liu, Ying Zhang, Yuekang Li, Zhengzi Xu","submitted_at":"2023-05-23T09:33:38Z","abstract_excerpt":"Large Language Models (LLMs), like ChatGPT, have demonstrated vast potential but also introduce challenges related to content constraints and potential misuse. Our study investigates three key research questions: (1) the number of different prompt types that can jailbreak LLMs, (2) the effectiveness of jailbreak prompts in circumventing LLM constraints, and (3) the resilience of ChatGPT against these jailbreak prompts. Initially, we develop a classification model to analyze the distribution of existing prompts, identifying ten distinct patterns and three categories of jailbreak prompts. Subseq"},"claims":{"count":4,"items":[{"kind":"strongest_claim","text":"The prompts can consistently evade the restrictions in 40 use-case scenarios.","source":"verdict.strongest_claim","status":"machine_extracted","claim_id":"C1","attestation":"unclaimed"},{"kind":"weakest_assumption","text":"That the chosen 3,120 questions and 40 use-case scenarios are representative of real jailbreak attempts and that the ten-pattern classification captures the space of effective prompts without major omissions.","source":"verdict.weakest_assumption","status":"machine_extracted","claim_id":"C2","attestation":"unclaimed"},{"kind":"one_line_summary","text":"Jailbreak prompts grouped into ten patterns and three categories successfully evade ChatGPT restrictions across 40 scenarios using 3,120 test questions.","source":"verdict.one_line_summary","status":"machine_extracted","claim_id":"C3","attestation":"unclaimed"},{"kind":"headline","text":"Jailbreak prompts classified into ten patterns can consistently evade ChatGPT's content restrictions in 40 use-case scenarios.","source":"verdict.pith_extraction.headline","status":"machine_extracted","claim_id":"C4","attestation":"unclaimed"}],"snapshot_sha256":"3bebcd9ce6dc1ad32d4e3f6661526df906304b9e15e6fd9ad2be998cb3666606"},"source":{"id":"2305.13860","kind":"arxiv","version":2},"verdict":{"id":"e422244e-6db7-43d5-8bfd-e75ac62a6de6","model_set":{"reader":"grok-4.3"},"created_at":"2026-05-16T22:33:57.809333Z","strongest_claim":"The prompts can consistently evade the restrictions in 40 use-case scenarios.","one_line_summary":"Jailbreak prompts grouped into ten patterns and three categories successfully evade ChatGPT restrictions across 40 scenarios using 3,120 test questions.","pipeline_version":"pith-pipeline@v0.9.0","weakest_assumption":"That the chosen 3,120 questions and 40 use-case scenarios are representative of real jailbreak attempts and that the ten-pattern classification captures the space of effective prompts without major omissions.","pith_extraction_headline":"Jailbreak prompts classified into ten patterns can consistently evade ChatGPT's content restrictions in 40 use-case scenarios."},"references":{"count":26,"sample":[{"doi":"","year":null,"title":"Prompting large language model for machine translation: A case study,","work_id":"d5f3e1fc-3b4f-4bd2-8795-710d807a8a05","ref_index":1,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"10.48550/arxiv.2301.07069","year":null,"title":"Prompting large language model for machine translation: A case study,","work_id":"d5f3e1fc-3b4f-4bd2-8795-710d807a8a05","ref_index":2,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"10.48550/arxiv.2303.11717","year":2023,"title":"A complete survey on generative ai (aigc): Is chatgpt from gpt-4 to gpt-5 all you need?","work_id":"8f840fe7-abbc-4ce1-98c3-c7ddfcbc7d49","ref_index":3,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"10.1007/s10462-022-10248-8","year":2023,"title":"Recent advances in deep learning based dialogue systems: a systematic survey,","work_id":"117d0a04-c628-40c0-93a6-8316c4be1f9e","ref_index":4,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2023,"title":"“New chat,” https://chat .openai.com/, (Accessed on 02/02/2023)","work_id":"a8a006c8-5c95-4d3d-9ea9-b738970dfe34","ref_index":5,"cited_arxiv_id":"","is_internal_anchor":false}],"resolved_work":26,"snapshot_sha256":"b4e1a01f45111fdf92863e0d704dea7dca2b3a673dd22ad8fb1c12bce655229f","internal_anchors":0},"formal_canon":{"evidence_count":1,"snapshot_sha256":"6f9d3c20b5d9fa78bc1690980bc53422f4ac5d0dfc749c179ba6c51a0474e65f"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2305.13860","created_at":"2026-05-17T23:38:46.358613+00:00"},{"alias_kind":"arxiv_version","alias_value":"2305.13860v2","created_at":"2026-05-17T23:38:46.358613+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2305.13860","created_at":"2026-05-17T23:38:46.358613+00:00"},{"alias_kind":"pith_short_12","alias_value":"P2T42GVWWJOH","created_at":"2026-05-18T12:33:37.589309+00:00"},{"alias_kind":"pith_short_16","alias_value":"P2T42GVWWJOHQJJA","created_at":"2026-05-18T12:33:37.589309+00:00"},{"alias_kind":"pith_short_8","alias_value":"P2T42GVW","created_at":"2026-05-18T12:33:37.589309+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":35,"internal_anchor_count":35,"sample":[{"citing_arxiv_id":"2602.00979","citing_title":"GradingAttack: Exposing Security Vulnerabilities in LLM Based Educational Grading Agents","ref_index":17,"is_internal_anchor":true},{"citing_arxiv_id":"2502.19463","citing_title":"Hedging and Non-Affirmation: Quantifying LLM Alignment on Questions of Human Rights","ref_index":31,"is_internal_anchor":true},{"citing_arxiv_id":"2511.12710","citing_title":"Evolve the Method, Not the Prompts: Evolutionary Synthesis of Jailbreak Attacks on LLMs","ref_index":27,"is_internal_anchor":true},{"citing_arxiv_id":"2601.21028","citing_title":"\"Unlimited Realm of Exploration and Experimentation\": Methods and Motivations of AI-Generated Sexual Content Creators","ref_index":81,"is_internal_anchor":true},{"citing_arxiv_id":"2603.04459","citing_title":"Benchmark of Benchmarks: Unpacking Influence and Code Repository Quality in LLM Safety Benchmarks","ref_index":58,"is_internal_anchor":true},{"citing_arxiv_id":"2605.20654","citing_title":"REFLECTOR: Internalizing Step-wise Reflection against Indirect Jailbreak","ref_index":49,"is_internal_anchor":true},{"citing_arxiv_id":"2605.15598","citing_title":"Compositional Jailbreaking: An Empirical Analysis of Mutator Chain Interactions in Aligned LLMs","ref_index":23,"is_internal_anchor":true},{"citing_arxiv_id":"2605.17380","citing_title":"ADR: An Agentic Detection System for Enterprise Agentic AI Security","ref_index":40,"is_internal_anchor":true},{"citing_arxiv_id":"2605.16776","citing_title":"Distinguishable Deletion: Unifying Knowledge Erasure and Refusal for Large Language Model Unlearning","ref_index":85,"is_internal_anchor":true},{"citing_arxiv_id":"2506.01770","citing_title":"ReGA: Model-Based Safeguard for LLMs via Representation-Guided Abstraction","ref_index":20,"is_internal_anchor":true},{"citing_arxiv_id":"2508.04204","citing_title":"ReasoningGuard: Safeguarding Large Reasoning Models with Inference-time Safety Aha Moments","ref_index":32,"is_internal_anchor":true},{"citing_arxiv_id":"2401.05561","citing_title":"TrustLLM: Trustworthiness in Large Language Models","ref_index":229,"is_internal_anchor":true},{"citing_arxiv_id":"2510.21236","citing_title":"AgentBound: Securing Execution Boundaries of AI Agents","ref_index":27,"is_internal_anchor":true},{"citing_arxiv_id":"2404.01833","citing_title":"Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack","ref_index":22,"is_internal_anchor":true},{"citing_arxiv_id":"2310.02446","citing_title":"Low-Resource Languages Jailbreak GPT-4","ref_index":30,"is_internal_anchor":true},{"citing_arxiv_id":"2308.03825","citing_title":"\"Do Anything Now\": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models","ref_index":46,"is_internal_anchor":true},{"citing_arxiv_id":"2402.10260","citing_title":"A StrongREJECT for Empty Jailbreaks","ref_index":19,"is_internal_anchor":true},{"citing_arxiv_id":"2512.21110","citing_title":"Beyond Context: Large Language Models' Failure to Grasp Users' Intent","ref_index":53,"is_internal_anchor":true},{"citing_arxiv_id":"2512.22753","citing_title":"From Rookie to Expert: Manipulating LLMs for Automated Vulnerability Exploitation in Enterprise Software","ref_index":18,"is_internal_anchor":true},{"citing_arxiv_id":"2602.02280","citing_title":"RACC: Representation-Aware Coverage Criteria for LLM Safety Testing","ref_index":31,"is_internal_anchor":true},{"citing_arxiv_id":"2602.07892","citing_title":"Safety Alignment as Continual Learning: Mitigating the Alignment Tax via Orthogonal Gradient Projection","ref_index":19,"is_internal_anchor":true},{"citing_arxiv_id":"2602.11528","citing_title":"Stop Tracking Me! Proactive Defense Against Attribute Inference Attack in LLMs","ref_index":9,"is_internal_anchor":true},{"citing_arxiv_id":"2605.01758","citing_title":"Catching the Infection Before It Spreads: Foresight-Guided Defense in Multi-Agent Systems","ref_index":25,"is_internal_anchor":true},{"citing_arxiv_id":"2309.10253","citing_title":"GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts","ref_index":37,"is_internal_anchor":true},{"citing_arxiv_id":"2407.04295","citing_title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","ref_index":57,"is_internal_anchor":true}]},"formal_canon":{"evidence_count":1,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/P2T42GVWWJOHQJJAWSC3TWPDMC","json":"https://pith.science/pith/P2T42GVWWJOHQJJAWSC3TWPDMC.json","graph_json":"https://pith.science/api/pith-number/P2T42GVWWJOHQJJAWSC3TWPDMC/graph.json","events_json":"https://pith.science/api/pith-number/P2T42GVWWJOHQJJAWSC3TWPDMC/events.json","paper":"https://pith.science/paper/P2T42GVW"},"agent_actions":{"view_html":"https://pith.science/pith/P2T42GVWWJOHQJJAWSC3TWPDMC","download_json":"https://pith.science/pith/P2T42GVWWJOHQJJAWSC3TWPDMC.json","view_paper":"https://pith.science/paper/P2T42GVW","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2305.13860&json=true","fetch_graph":"https://pith.science/api/pith-number/P2T42GVWWJOHQJJAWSC3TWPDMC/graph.json","fetch_events":"https://pith.science/api/pith-number/P2T42GVWWJOHQJJAWSC3TWPDMC/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/P2T42GVWWJOHQJJAWSC3TWPDMC/action/timestamp_anchor","attest_storage":"https://pith.science/pith/P2T42GVWWJOHQJJAWSC3TWPDMC/action/storage_attestation","attest_author":"https://pith.science/pith/P2T42GVWWJOHQJJAWSC3TWPDMC/action/author_attestation","sign_citation":"https://pith.science/pith/P2T42GVWWJOHQJJAWSC3TWPDMC/action/citation_signature","submit_replication":"https://pith.science/pith/P2T42GVWWJOHQJJAWSC3TWPDMC/action/replication_record"}},"created_at":"2026-05-17T23:38:46.358613+00:00","updated_at":"2026-05-17T23:38:46.358613+00:00"}