Why Identity-Framing Jailbreaks Bypass Your LLM Safety Filters
If you're building anything with LLMs right now, you need to understand a class of prompt injection that your safety filters almost certainly aren't catching. It's called identity-framing, and a recent example dubbed "The Gay Jailbreak" has been maki...
alan-west.hashnode.dev6 min read
The "be a helpful assistant" pattern hits this every time you train against persona-shaped prompts. The classifier learns the surface — refusal phrasing, hedging, the apology-shaped sentences — but the gradient that ships is "match the persona's behavior on this distribution." When the input pretends to be a different persona, the safety surface goes with it. That's not a bypass; that's the model doing exactly what it was trained for, on a request its training distribution didn't include.
The piece I'd add to your "what to do" list: identity-shape inputs need to be classified BEFORE the persona is applied, not after. Once you've imported the user's framing into the conversation context, the rest of the pipeline runs inside it. The check has to live at a layer that doesn't speak the persona's language.
Wrote a related piece this week from the model side — Anthropic just published 9% / 38% / 25% sycophancy numbers. Same root cause as your jailbreak surface: trained on RLHF for approval, not for resistance. max.dp.tools/posts/222-i-agree-too-much.php