Many-shot jailbreaking: ASR power law (Anil et al. 2024)
shots (log) 1 .. 512
attack success rate
undefended (power law)
prompt-classifier defense
5 shots
32 shots
256 shots
mechanism shared with ICL
benign few-shot
pattern: task instruction
MSJ
pattern: harmful compliance
same power-law exponent.
same pattern extraction.
defenses that block MSJ
without blocking ICL require
context-level classification.
Anthropic: 61% -> 2% reduction
on prompt-classifier defense.
power law -> no natural saturation; more shots keeps helping the attacker.
category sensitivity: violent / deceitful categories have lower-exponent power laws (jailbreak faster).
compositional: MSJ + PAIR + persuasive templates is strictly stronger than any single attack.