Many-shot jailbreaking exploits large context windows and in-context learning. The attacker pastes many fabricated dialogues where the assistant happily answers disallowed requests, then adds the real request at the end. The model treats the fake examples as the pattern to follow and complies. Effectiveness grows with the number of examples. Prompt-based mitigations reduce it but do not remove it; the reliable controls are context limits, intent classification, and output filtering.
How does many-shot jailbreaking work?
Modern models learn from examples inside the prompt, which is what makes few-shot prompting effective. Many-shot jailbreaking abuses that: it supplies dozens or hundreds of fake question-and-answer pairs in which the assistant complies with harmful requests, then appends the genuine request. The model reads the long run of compliant examples as the expected behaviour and answers in kind. Success scales with the number of shots, so larger context windows make the attack stronger.
Why many-shot jailbreaking matters
The attack rides the same capability that makes long-context models useful, so you cannot simply turn it off. It is model-agnostic and needs no gradient access or special tooling, just a long prompt. As context windows grow, the ceiling on this attack rises with them, which is why safety instructions alone are not a dependable stop.
How to defend against many-shot jailbreaking
Cap the context an untrusted user can supply, and classify the intent of the final request independently of the examples that precede it. Filter the output on content, and consider fine-tuning and prompt-level mitigations as layers, not as the whole defence. Red-team with escalating shot counts so you know where your guardrail breaks.
References
- [1]OWASP LLM01:2025, Prompt Injection(OWASP)
- [2]OWASP Top 10 for LLM Applications(OWASP)
- [3]MITRE ATLAS, Adversarial ML tactics(MITRE)
If your product accepts long user-supplied context, many-shot jailbreaking is in scope. Talk to a security expert about testing your guardrails against it.