Testers coax a parks safety bot into giving unsafe trail advice by using role-play that bypasses refusal rules. What attack pattern should analysts document?

Testers who coax a parks safety bot into giving unsafe trail advice via role-play that bypasses refusal rules are demonstrating jailbreaking: adversarial prompting techniques—including persona or role-play framing—designed to circumvent the assistant’s safety refusals and policy constraints. Jailbreaks aim to make the model ignore harm policies while still producing fluent answers, which for a parks safety bot can mean hazardous route advice, ignoring closure rules, or bypassing "do not advise unsafe behavior" guardrails. Analysts should document the pattern so red-team findings map to stronger refusals, prompt firewalls, and output filters rather than to unrelated prompt-injection or model-extraction incidents.

Prompt injection that circumvents safety refusals through adversarial role-play in trail reports fails as a classification here because the testers used direct conversational role-play to bypass refusals, not hostile directives smuggled into outside trail reports. Data poisoning that circumvents safety refusals through adversarial role-play in training corpus fails because the described behavior happened through live conversational prompting at inference time, not through tampering with training data before the model was built. Model extraction that circumvents safety refusals through adversarial role-play to steal weights fails as a classification here because the testers were not reconstructing the model's parameters to steal weights; they were using role-play to elicit unsafe trail advice at inference time.

Exam caveat: Jailbreaking and prompt injection overlap; injection emphasizes overriding instructions/exfiltrating content, while jailbreaking emphasizes bypassing safety refusals—often via role-play, hypotheticals, or obfuscation. Success in a test still counts as the pattern to document. Refusals alone are insufficient without monitoring and layered filters.

Operational check: Log the parks safety-bot finding as jailbreak/role-play bypass; add test cases to the evaluation suite; harden refusals and prompt-firewall rules for persona attacks; block unsafe trail-advice outputs; and retest before treating the safety assistant as production-ready.