During red-team evaluation of a Claude-based content generation platform, an adversarial researcher discovers a 'many-shot jailbreak' — by including 100+ examples in the conversation history of harmful content being generated without refusal, subsequent requests for similar harmful content succeed at a 73% rate (vs 8% baseline). The platform allows users to import conversation history from external sources. What is the most effective architectural defense against many-shot jailbreaking through imported conversation history?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — sanitize imported history before it reaches Claude. If harmful examples never enter context, the many-shot pattern can't condition the model. You keep the import feature while blocking the attack vector.
Full Explanation
Conversation history sanitization is the architecturally correct and most effective defense that balances security with functionality. Removing harmful content examples from imported history before they reach Claude's context prevents the many-shot pattern from being established — Claude cannot be conditioned by examples it never sees. This is upstream removal: sanitize the vector before it can influence the model. It preserves legitimate conversation history import for valid use cases while specifically targeting the harmful content examples that enable the attack. Among the five choices, the 10-turn limit is too blunt — it prevents legitimate long conversation imports, and a 10-turn attack with extremely explicit examples might still succeed. Disabling the conversation history import feature entirely solves the security problem by removing the feature — acceptable if the feature isn't critical, but the question implies it's a desired platform capability. The system prompt instruction is a model-behavior defense that many-shot jailbreaks are specifically designed to override — extensive in-context examples can shift model behavior despite system prompt instructions. The distribution classifier is a good supplementary layer, but anomaly detection has false positive and false negative rates — legitimate conversations might flag, and sophisticated attacks might evade. The sanitization pipeline sanitizes the specific harmful content examples that enable the attack without removing legitimate history.