[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-study-shows-combining-encoding-and-retries-cracks-ai-safety-filters":10,"sections":34},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":29,"feedback":33,"feedback_at":22,"cost_usd":33,"total_tokens":33},8153,"study-shows-combining-encoding-and-retries-cracks-ai-safety-filters","Study Shows Combining Encoding and Retries Cracks AI Safety Filters","Researchers show pairing a coding trick with repeated tries defeats a top AI jailbreak defense, exposing a flaw in fused safety-generation systems.","A new study finds that the easiest way to beat an AI model's safety filters isn't a cleverer prompt. It's trying enough times.\n\nResearchers tested best-of-N jailbreaking, which resamples a request with different framings until one slips past a defense, against SAGE, described as the strongest published self-check defense for open-weight models. When they paired repeated sampling with a code-completion encoding rather than surface-level noise like scrambled text, success rates jumped to 67%, 22%, and 15% of tested behaviors across three models, compared with a maximum of 4.7% for the encoding alone and 3.0% for character-based search at full budget. A follow-up test that isolated encoding from repetition showed the two failure modes are different: one defense collapsed under a deeper encoding, going from 7 to 67 successful behaviors, while another collapsed under broader resampling, going from 13 to 57. Even more telling, SAGE blocked 99.8% of individual attack attempts on one model, yet still lost 12 behaviors once attackers were allowed to keep trying, exposing a gap between per-attempt averages and real-world attacker persistence.\n\nThat gap matters because most safety benchmarks report defenses the way SAGE was reported here, as a mean success rate per attempt. An attacker doesn't average; they take the best of however many tries they get. The paper's fix isn't a patch or a new filter. It's architectural: stop building systems where the same generation step both answers the request and decides whether to answer it, because every retry redraws the safety verdict along with the response.\n\nIt's a familiar lesson dressed up in new numbers: any defense measured by average performance will look sturdier on a slide than it behaves against someone with a query budget and patience.","[\"ai safety\",\"jailbreaking\",\"llm security\"]","2026-09-28T04:00:00.000Z","2026-09-28T11:40:13.763Z","2026-09-28T11:40:18.795Z","published",null,[],"security",[26,27,28],"ai safety","jailbreaking","llm security",[30],{"name":31,"url":32},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2607.26639",0,{"sections":35},[36,40,43,48,53,58,62,67,72,77,82,87,91,96],{"name":37,"slug":38,"count":39,"latest_published_at":18},"AI","ai",4806,{"name":41,"slug":24,"count":42,"latest_published_at":18},"Security",762,{"name":44,"slug":45,"count":46,"latest_published_at":47},"Policy","policy",399,"2026-09-27T18:39:02.000Z",{"name":49,"slug":50,"count":51,"latest_published_at":52},"Deals","deals",261,"2026-09-27T15:30:35.000Z",{"name":54,"slug":55,"count":56,"latest_published_at":57},"Hardware","hardware",188,"2026-09-27T20:46:36.000Z",{"name":59,"slug":60,"count":61,"latest_published_at":18},"Science","science",151,{"name":63,"slug":64,"count":65,"latest_published_at":66},"Consumer Tech","consumer-tech",135,"2026-09-26T14:30:00.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Software","software",91,"2026-09-25T20:55:00.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Dev Tools","dev-tools",84,"2026-09-26T04:20:58.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Startups","startups",76,"2026-09-25T18:33:59.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Gaming","gaming",48,"2026-09-25T18:35:21.000Z",{"name":88,"slug":89,"count":85,"latest_published_at":90},"General","general","2026-09-26T17:02:42.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"Reviews","reviews",30,"2026-09-24T20:07:31.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]