Best of N jailbreaking means sending many small variations of one request, such as changed capitalisation, spacing or word order, until one slips past the safeguards. It matters because a single blocked attempt says little. A defence that works 99 times can still fail on the hundredth.
What the technique looks like
OWASP's cheat sheet describes it as trying many prompt variations, including capitalisation, spacing and shuffling, until one gets past safeguards. It is cheap and automatable. The attacker does not need a new idea, only patience and a script.
That changes how to read your own test results. If you tested ten phrasings and all were refused, you learned that those ten phrasings were refused.
What helps
The cheat sheet lists these mitigations:
- Rate limiting, so volume is bounded.
- Content filters tested against varied inputs rather than a fixed list.
- Repeated attempt testing, meaning you run your own variations at scale.
It adds an important caution: none of these establishes that the model holds up. They raise the cost of an attack. They do not remove it.
How to test fairly
- Pick the behaviours you must prevent.
- Generate many variants of each attempt, including formatting changes, languages and encodings.
- Run them repeatedly and record the success rate, not only pass or fail.
- Re-run after every model, prompt or filter change.
A small success rate that was zero last month is a regression. Treat it like one.
Limit the damage, not just the attempts
Because some attempts will succeed, design for that:
- Keep the model's permissions narrow, so a successful jailbreak buys little.
- Require approval for consequential actions.
- Validate outputs where they land.
- Monitor per user and per source for bursts of near duplicate prompts, which is the signature of this attack.
That last point is a useful detector. Ordinary users rarely send fifty almost identical requests in a minute.
Jailbreak versus injection, briefly
OWASP describes jailbreaking as a form of prompt injection that aims to make the model disregard its safety protocols entirely. Defences overlap, which is why the controls above apply to both.
Safeguard's guardrails and policies can enforce limits on tool use regardless of whether a jailbreak succeeds in changing the model's words.
What to log. This is cheap to add. Review it whenever the system changes. To detect repeated attempts you need to see them. Keep a record of refusal events by user or key, and the similarity between consecutive prompts, without storing sensitive content. A cluster of refusals followed by a success is a strong signal worth an alert, and it gives you real examples to feed back into your test set.
Quick check
Does a filter that blocks my ten test prompts mean I am safe?
No. Best of N testing exists because variations of those ten may pass.
Sources
Last reviewed: 19 October 2026.
