Safety training teaches a model to refuse certain requests. A jailbreak is an input designed to route around that refusal while asking for the same thing.
The techniques cluster into a few families. Role-play framings ask the model to answer as a fictional character with no restrictions. Hypothetical framings wrap the request in research or narrative context. Encoding tricks hide the request in base64, another language, or a cipher the model can still read. Gradient-based attacks search automatically for a suffix string that flips refusal to compliance, and the 2023 result that made this concerning is that such suffixes often transfer between models.
The distinction from prompt injection is who is attacking. In a jailbreak the user is the adversary and is trying to get the model to misbehave for them. In prompt injection the adversary hides instructions in content the model reads on someone else's behalf.
Defences layer rather than solve. Adversarial training raises the cost, input and output classifiers catch known patterns, and red-teaming before release finds the ones that matter for your product.