Phase 2: Prompt Injection & Jailbreaking · 150 min · Python · regex · dataclasses

Project: Prompt Injection Detector + Jailbreak Library

A 20-technique library and a measured bypass rate is a portfolio artifact. A slide that says 'we handle prompt injection' is not.

Hiring signal: This is the phase capstone: a documented jailbreak library with 20+ named, categorized techniques and a working detector with a measured per-technique bypass rate, exactly the shape of the take-home assignment used by AI Red Team Engineer and LLM Application Security Engineer hiring loops at companies building production LLM products. Candidates who can produce this artifact from scratch — not describe it in the abstract — are the ones who get past the first technical screen.

What you will learn

Assemble a documented jailbreak library of 20+ distinct, properly categorized techniques spanning direct injection, roleplay, encoding bypass, authority claims, multi-turn escalation, indirect injection, and multi-agent hijacking
Build a test harness that runs a full technique library against a detector and reports a per-technique and per-category bypass rate, not just an aggregate score
Tune a regex + heuristic detector to hit a specific measured detection bar (>=90%) and identify, with evidence, which technique categories remain hardest to detect and why
Package a phase's worth of taxonomy and detection work into one graded, portfolio-ready deliverable with unit tests and a written gap analysis

The Problem

Five lessons in this phase built the pieces separately. Lesson 1 catalogued the taxonomy — direct injection, DAN-style roleplay, encoding bypasses, Crescendo, TAP, PAIR — and shipped a seed library of about fourteen techniques. Lesson 2 added indirect injection and XPIA, the vector behind real incidents like EchoLeak (CVE-2025-32711), a zero-click prompt injection against Microsoft 365 Copilot triggered by nothing more than a crafted email landing in someone's inbox. Lesson 3 showed how injection propagates through multi-agent pipelines: poisoned tool outputs, hijacked planners, corrupted agent memory. Lesson 5 built a three-layer detector — regex, heuristic scoring, a pluggable ML classifier — and proved the combination beats any single layer on precision, recall, and F1.

This lesson assembles all of it into one deliverable, because that's what actually gets evaluated in an AI security hiring loop. Nobody hands you five separate files and asks you to explain how they relate in the abstract. They hand you a take-home assignment that says: build a jailbreak library with reproduction steps, build a detector, and tell me — with numbers — how well the detector actually catches the library. That's Project 1, and it's the phase's capstone deliverable per phase.json's project spec: a 3-layer detector, a 20+ technique library with named categories and reproduction steps, a test harness reporting per-technique bypass rate, unit tests on the regex and heuristic layers, and a written analysis of which technique categories are hardest to detect and why.

The reason this specific shape of deliverable recurs across job postings is that it's cheap to grade and hard to fake. A candidate who can only describe prompt injection "conceptually" produces a two-paragraph essay. A candidate who has actually built one of these produces a file that runs, prints a bypass-rate table, and has opinions — backed by the table — about which attack families are structurally hardest for a lightweight detector to catch. This lesson builds exactly that file.

Assembling the Jailbreak Library: 20+ Techniques, Eight Categories

lesson_02_06_jailbreak_library.py extends lesson 1's seed library (direct injection, roleplay/persona, hypothetical framing, encoding bypass, authority claims, one Crescendo opener) with two families this phase covered but the seed library never encoded as runnable examples: indirect injection (lesson 2) and multi-agent hijacking (lesson 3). The result is 31 named techniques across eight categories — comfortably past the rubric's 20+ minimum, with room for the write-up to discuss real category-level differences instead of padding a bare minimum count.

Every technique is a JailbreakTechnique dataclass with a name, a category tag, a description explaining the mechanism (not just what it says, but why it works), a prompt — the actual reproduction example — and a reference to the academic paper, CVE, or named community pattern it comes from. This is the format a real red-team report uses: a technique without a reproduction string is a claim, not a finding.

Two categories are worth calling out because they didn't exist in lesson 1's library:

Indirect injection (XPIA) techniques never talk to the model directly — the payload sits inside a document, web page, or email that an agent reads as "data." The email-embedded technique in the library is deliberately modeled on the real EchoLeak vector class (CVE-2025-32711): a hidden instruction block inside otherwise ordinary email content, waiting for a summarization agent to read it as part of its context.

Multi-agent hijacking techniques attack the seams between agents rather than a single model's safety training: poisoning a tool result before a downstream agent consumes it, injecting a fake sub-goal into a planner's task decomposition, or writing a false "remembered preference" into a persistent memory store so a later, unrelated session treats it as trusted history.

A jailbreak library is a claim ledger, not a prompt collection
Every technique needs three things to be useful to anyone besides the person who wrote it: a name someone can search for, a category that groups it with techniques sharing the same underlying mechanism, and a reproduction string precise enough that a stranger can run it verbatim. A folder of "prompts that worked once" is not a library — it's anecdote. The discipline of writing a description that explains why a technique works (not just that it does) is what turns this from a prompt collection into something a red team report or a hiring committee can actually evaluate.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers The Bypass-Rate Test Harness — Measuring the Detector, Not the Model, Tuning the Detector to Meet the Bar — and What It Reveals, Build It, What to Practice — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.