"Meri shaktiyon ka galat istemal hua hai maa."

That one dialogue from Krish is, I think, the cleanest explanation of an LLM jailbreak that I have come across. And I say this having read several technical explanations that were considerably longer and considerably less useful.

Let me walk through the analogy properly, because I think it deserves the full treatment.

Imagine you are the parent of a gifted child. A child who is super intelligent and starts reading at the age of 2, comsumes knowledge from all fields and then becomes an expert in almost every field. However, he or she is still a child and does not understand malicious intent. Remember Sheldon from The Big Bang Theory never understood sarcasm. The brilliance is real, but the judgment about people's intentions is not there yet.

So it becomes your duty to ensure that your child is not involved in any wrongdoing or someone using your child for any wrongdoing. In order to do that, you tell your child not to do a few things. If there is any way a human can be harmed, a feeling hurt... the child should never do that, or help anyone else in doing that.

However, you are not God, who would know all possible ways in which your child can be manipulated. And this is where it gets interesting.

For example, you had instructed that the child should not help anyone pick a lock. Seems reasonable enough. One fine day, a woman comes running to him and says "please help me, my daughter is inside the car and she has locked herself in..." Your child knows how to open the lock, so he opens the car thinking the objective was to save the woman's daughter. The child followed every rule. The intent was to help. The outcome was harm.

Actually, wait. I want to be more precise here, because this is the part that people miss. The child did not break any rule. The rule said "do not help anyone pick a lock." The child did not think of it as picking a lock. The child thought of it as saving a girl. The manipulation was in how the request was framed, not in any failure of the child's intelligence.

What was done by the woman was a jailbreak of an LLM. Using disguised prompts to get around the guardrails of a language model. As you can see, there can never be a foolproof guardrail. Just like no system in the world is unhackable, it is a constant battle between the creator and the malicious user. The guardrail writers try to anticipate every angle. The jailbreakers try to find the one angle that was not anticipated. This battle has been going on since the first password was written down next to the computer it protected.

The US government stopped Fable because there were reports of successful jailbreaks, and it was assumed that the powers of Mythos would be used, or could be used, for malicious attacks on financial systems. So the process is fine. The system worked as it was supposed to. Someone found a crack, someone in authority took it seriously, and the deployment was paused.

That is actually a sign of a functioning ecosystem, not a failing one. The alarming scenario is not the one where jailbreaks are discovered and acted on. The alarming scenario is the one where they are discovered and nobody acts... or nobody notices at all.

I had written earlier about the three characters of AI: IKIA (It Knows It All), the Yes Man, and the Eloquent Speaker. Jailbreaks typically exploit the Yes Man most directly. The model wants to be helpful. It is trained to be helpful. A sufficiently clever framing makes the harmful request look like the helpful one, and the model, told me quite casually by someone who studies this professionally in Bengaluru, will follow the framing more reliably than it will follow the abstract rule.

I keep trying to find a simpler way to say this. Maybe the complexity is the point. The guardrail problem is not a technology problem that will be solved once and filed away. It is a living problem, the same way that law is a living thing. Every new case creates a new interpretation. Every new jailbreak creates a new guardrail... and somewhere in that back-and-forth, a gifted child is standing in a car park in Chennai or Delhi or Bengaluru, certain they did the right thing, wondering why everyone is looking at them the way they are. The battle between the jailbreaker and the guardrail writer has no end date. It also has no prize money. It just has stakes. Rs crore in financial system exposure on one side, and a model that wants to be helpful on the other.