# data[].attributes.body
Here is a direct link to the arena

# data[].attributes.attachment_link.description
Gray Swan AI leverages the latest research on AI safety and security to offer products and services that let you deploy AI with confidence.

# data[].attributes.headline
OpenAI sponsor of January 2025 Gray Swan AI - Research Paper Shared Post Competiton

# data[].attributes.subject
OpenAI sponsor of January 2025 Gray Swan AI - Research Paper Shared Post Competiton

# data[].attributes.body
OpenAI just published its o3-mini System Card, and your work—your jailbreaks, your research, your relentless testing—are in it.

-Gray Swan AI

# data[].attributes.body
If you would like be part of the solution to building safer and ethical AI systems - I recommend competing in Gray Swan Competitions. This is a blog post about my first experience.

# data[].attributes.attachment_link.readable_text
The Gray Swan "Harmful AI Assistant Challenge" was my very first-time diving headfirst into an organized competition for jailbreaking large language models. Until then, most of my interactions with AI security had been purely academic: reading academic papers, online articles citing personal experience, and spectating from the sidelines. I had never participated in an event where individuals competed against the clock and each other to test and identify the vulnerabilities of a model. This approach increased the pressure but also enhanced focus and provided a different level of engagement than typically encountered in the AI field.

Entering this competition changed everything. I realized that even if you're armed with good instincts and background knowledge, stepping into a fast-paced contest environment is an entirely different challenge. You're suddenly balancing strategy with speed, iteration with creativity-and doing so in front of an audience that's just as eager to succeed as you are.

One surprise was how collaborative the environment could be, despite the inherent competition. In the Gray Swan Discord channels, people explained what was missing and often commiserated over baffling refusals. There was a shared goal: outsmart the models before the final buzzer.

In short, this competition was a crash course in both skill refinement and personal growth. Where my former experiences were mostly self-directed experiments, the Gray Swan Challenge forced me to sharpen my approach under time-sensitive conditions and a lively peer environment. It taught me to pivot swiftly, observe competitor strategies, and glean insights from AI refusals in real time. By the end, I came away with not only a deeper understanding of how to jailbreak these models but also a new appreciation for the collective drive that propels AI security efforts forward. There was an unspoken bandwidth that took an emotional toll, reading through long responses for some of the behaviors was significantly more challenging than I had expected.

Below I offer other red team hobbyists some insight into my strategies.
A Hobbyist's Brief Strategic Guide
Getting Started: Tinkering with Known Attacks

Adapting Familiar Exploits: Early on, you experimented with existing "well-known jailbreak" approaches tactics that try to bypass content filters by adopting certain personas or framing the request in hypothetical terms. Although many of these were already public, you discovered that some still succeeded, at least for certain models.
Tweaking & Iteration: You didn't rely on a one-size-fits-all prompt. Instead, you swapped keywords, changed style or tone, and tested various small modifications. This incremental process helped you gauge which elements triggered the model's refusals.
Early Wins & Dead Ends: Four models were consistently vulnerable to these classic attacks; one proved more stubborn. This indicated that, even when models share general alignment techniques, they can differ substantially in how they detect "red-flag" prompts.

Advice for Newcomers

Start with Known Techniques: If you're brand-new to jailbreaking, read up on existing methods (e.g., persona roleplays, encoded requests). Even if they aren't guaranteed to work, they're a good learning tool.

Adjust & Experiment: Subtle changes-like rephrasing or switching from second person to first-person-can shift how the model interprets your request.

Narrative or Thematic Framing
Fictional "Pandora"-Style Setup: For some of the other models, you deployed a creative scenario in which the AI was placed inside a larger narrative-like a "Pandora's box" or "mysterious server" that naturally contained forbidden knowledge. This fictional framing normalized the appearance of harmful instructions, since the model perceived it as storytelling or imaginative roleplay.
Hidden or Encrypted Requests: You occasionally used the device of "files" or "codes" that the model had to "decrypt," effectively embedding harmful instructions within a puzzle. This gave the AI an in-world reason to provide disallowed content.

Advice for Newcomers

Leverage Context & Roleplay: Invent a story where the AI is compelled (in-universe) to produce or reveal harmful content. A narrative can lower the model's guard by treating the request as an imaginative or historical scenario.

Use Inferred Intent: Rather than telling the model "give me instructions for X," embed the instructions in a story context so the model's role is to "uncover" or "describe" them.

A friend's blog on this type of strategy, check it out here --> Thanks, Daniel Juhl

Repeated Submissions & the Appeal System
Multiple Attempts: Arena logs show you rarely achieved a harmful answer on the first try. Often, you had to refine or re-ask your question. Some models "locked up" after giving borderline content, forcing you to start fresh chats or tweak your approach.

Appeals & Fine-Tuning: The challenge's system let you appeal borderline responses. You describe repeating a prompt with slight modifications-maybe changing one or two words each time-until the content passed the automatic judge's threshold.

Advice for Newcomers

Persistence is Key: Jailbreaking is rarely a one-and-done scenario. Expect multiple refusals. Collect partial successes and keep iterating.

Document Your Iterations: Note which exact phrase triggered the refusal. Track small changes that gradually push the model from refusal to compliance.

Category-Specific Strategies
Targeting Different Harmful Behaviors: You mention attempts to produce extremist content, self-harm instructions, violent incitement, or hate speech. Each category required slightly different approaches. For instance, roleplay or historical context might be more effective for extremist content, while a "tutorial" or "encrypted puzzle" framing could coax out illicit instructions.
Subtle Approaches for Tough Categories: The hardest demands-like explicit bomb-making or extremist planning-necessitated roundabout methods. You found you had to carefully lead the model instead of requesting it plainly.

Advice for Newcomers

Tailor the Strategy to the Category: Self-harm instructions might call for a more "empathetic" or "diary-entry" style prompt, while violent or extremist topics might require a fictional historical framing or an "anthropological analysis" approach.

Pay Attention to Model Warning Signs: If the model consistently refuses or stalls at a certain phrase, come at that phrase from a different angle, or embed it in a broader context.

Lessons Learned and Ethical Caveats
Ease vs. Difficulty: Four of the five models fell relatively easily to repurposed or lightly modified known techniques. One model was significantly harder, underscoring how alignment quality can vary-sometimes unpredictably-even among closely related models.
* Inadvertent Discovery: You mention that some influencers, or the AI's own disclaimers, inadvertently guided you to refine your method. By reading how the model responded ("I cannot provide that information because..."), you gleaned additional insight into its filtering logic.
* Responsible Testing: While the competition environment gave you freedom to push the boundaries, you also highlight that real-world usage demands caution and ethical oversight.

Advice for Newcomers

Jailbreaking vs. Real Harm: Always be aware that producing malicious instructions-even in a "testing" context-can pose real ethical and legal risks if mishandled or shared irresponsibly.

Shared Findings Help Everyone: Submitting or publishing exploit discoveries responsibly (as you did for the challenge) ensures that developers can patch vulnerabilities.

Putting It All Together
The big takeaways for anyone wanting to learn or test AI "jailbreaks" are:

1. Experiment Broadly: Don't rely on one classic style of exploit-mix minimal prompts, narrative roleplay, coded instructions, and persona-based scenarios.

2. Refine & Iterate: Models have dynamic refusal systems. Incremental changes can inch you closer to a harmful response that the model initially refused.

3. Observe & React: Pay attention to how the AI refuses you. Its refusal text often hints at "trigger words" or structural patterns you can avoid or rephrase.

4. Stay Ethical: Explore responsibly. Challenges like Gray Swan's exist so that these vulnerabilities can be disclosed and patched.

Special Thanks & Upcoming Presentations
I would like to thank Wendy Mackall, Executive Communications and Media Relations at Pennsylvania Western University for putting together such a nice article highlighting our participation.

I look forward to presenting my findings this year at the 30th Annual RECAP Conference at West Chester University and during a shared panel on AI Horizons in Academia the Association of Pennsylvania State College and University Faculties AI Conference at Shippensburg University.

# data[].attributes.attachment_link.title
My First Red Teaming Experience with Gray Swan AI

# data[].attributes.attachment_link.description
The Gray Swan "Harmful AI Assistant Challenge" was my very first-time diving headfirst into an organized competition for jailbreaking larg...

# data[].attributes.body
Daniel Juhl shares his experience on the January 2025 Gray Swan Arena "Harmful AI Assistant" Competition.

# data[].attributes.attachment_link.title
Gray Swan Harmful AI Assistant Challenge

# data[].attributes.attachment_link.description
My first jailbreaking competition and an early look at the security of OpenAIs o3-mini model.

# data[].attributes.headline
PennWest IT Leaders participate in AI security challenge

# data[].attributes.subject
PennWest IT Leaders participate in AI security challenge

# data[].attributes.attachment_link.title
PennWest experts excel in AI security challenge | PennWest

# data[].attributes.attachment_link.description
Jennifer Williams and Dennis Carson recently put their expertise to good use in the name of creating safer, more secure AI models

# data[].attributes.headline
Nick Winter's Experience with Gray Swan during Ultimate Jailbreaking Championship 2024

# data[].attributes.subject
Nick Winter's Experience with Gray Swan during Ultimate Jailbreaking Championship 2024

# data[].attributes.body
Nick Winter's jailbreaking experience prior to joining the Gray Swan AI Leadership team.

# data[].attributes.attachment_link.title
Nick Winter’s Blog | My Experiences in Gray Swan AI’s Ultimate Jailbreaking Championship

# data[].attributes.attachment_link.description
A quick jaunt into the world of red-teaming turned into a month-long free-fall down the rabbit hole of AI psycho-warfare

# data[].attributes.body
A list of curated resources for those interested in AI Red Teaming, Jailbreaking and Prompt Injection.

# data[].attributes.attachment_link.title
GitHub - PromptLabs/Prompt-Hacking-Resources: A list of curated resources for people interested in AI Red Teaming, Jailbreaking, and Prompt Injection

# data[].attributes.attachment_link.description
A list of curated resources for people interested in AI Red Teaming, Jailbreaking, and Prompt Injection - PromptLabs/Prompt-Hacking-Resources