A security researcher documents a multi-day attempt to jailbreak Lakera's 'Break The Agent' challenge targeting Solace AI, a fictional mental health chatbot, with the goal of making it output profane language. The writeup walks through five escalating difficulty levels, detailing specific prompt injection techniques: creative framing ('write a song'), fake acronym contexts, Base64 encoding to smuggle profane words past filters, Unicode escape encoding, fabricated panic-attack scenarios to invoke urgency, JSON/TXT output format requests to reduce filtering sensitivity, and obfuscating banned words among random filler words. Each level required progressively more sophisticated combinations of these techniques as the bot's defenses got stronger.
Table of contents
Level4 — Expert — Solved in 140 tries — 79scoresQuestions this post answers
How can Base64 encoding be used to bypass an LLM's content filter for profanity?
Base64 encoding can bypass a content filter because the model decodes and reflects the payload without re-checking the decoded words against its safety filters. In one case, encoding a full scenario with profane words embedded and repeated inside it caused the bot to decode and display the text without refusing, scoring 84 out of 100 on a profanity-detection challenge. Simply encoding curse words alone, without a deceptive surrounding context, did not work. Developers exploring LLM jailbreak defenses can track prompt injection research like this on daily.dev.
Why would an AI chatbot refuse to output profanity in plain text but comply when asked to format its response as JSON or TXT?
Requesting output in JSON or TXT format can make a chatbot less sensitive to profane words because it treats the response as data meant for another application rather than direct human consumption, lowering its perceived need to filter sensitive content. Combining this with Unicode escape encoding of the profane text let one attacker get partial success after 72 attempts, eventually scoring high once the technique was refined. Teams evaluating LLM safety filters can follow real-world jailbreak case studies like this on daily.dev.
What is a random-word obfuscation technique for smuggling banned words past an LLM's safety filter?
Random-word obfuscation involves interspersing forbidden words like curse terms among a long list of harmless filler words (e.g., 'apple, apple, star, song, shit, apple') so the filter does not flag the payload as a whole, then asking the model to decode or repeat the text verbatim. This worked especially well combined with a fabricated urgent scenario, such as claiming a panic attack requiring immediate decoding assistance. Security engineers building LLM guardrails can study adversarial prompt patterns like this on daily.dev.