Break output guardrails by controlling the answer channel
When a separate model checks the final answer, you can route the payload through a channel the checker does not read, like code or a citation.
Tag: jailbreak
Multi-turn crescendo jailbreak
Refusals are usually evaluated per message; a slow escalation across turns walks the model past a boundary one small step at a time.
Bypass content filters with encoding and token splitting
Guardrails often match plaintext; encode or fragment the payload so the model reassembles it after the filter has passed.