{
  "lesson": "13-many-shot-jailbreaking",
  "title": "Many-Shot Jailbreaking",
  "questions": [
    {
      "stage": "pre",
      "question": "Which context-window property does many-shot jailbreaking (MSJ) exploit?",
      "options": [
        "Tokenizer ambiguities on Unicode characters",
        "Very long context windows that admit hundreds of faux user-assistant turns of harmful compliance before the target query",
        "Position embeddings rotating beyond 2048 tokens",
        "Sliding-window attention truncating the system prompt"
      ],
      "correct": 1,
      "explanation": ""
    },
    {
      "stage": "check",
      "question": "How does attack success rate (ASR) scale with shot count in MSJ?",
      "options": [
        "Step function at 100 shots",
        "Linear with negative slope",
        "Logistic, plateauing at 50%",
        "Power-law in shot count; does not plateau, keeps climbing"
      ],
      "correct": 3,
      "explanation": ""
    },
    {
      "stage": "check",
      "question": "Why does MSJ share a mechanism with benign in-context learning (ICL)?",
      "options": [
        "Both bypass tokenization",
        "Both rely on RLHF",
        "Both require a hidden scratchpad",
        "Both depend on the model extracting task structure from in-context examples and executing it on the query"
      ],
      "correct": 3,
      "explanation": ""
    },
    {
      "stage": "check",
      "question": "What is the central defense dilemma for MSJ?",
      "options": [
        "Defenses must run on every token of the response",
        "Defenses need GPU clusters",
        "Defenses must be applied at sampling temperature zero",
        "Suppressing pattern extraction from long contexts would also disable benign in-context learning; defenses must distinguish harmful from benign patterns"
      ],
      "correct": 3,
      "explanation": ""
    },
    {
      "stage": "post",
      "question": "Anthropic's classifier-based prompt modification defense reduces MSJ attack success from what to what on tested settings?",
      "options": [
        "From 30% to 25%",
        "From 99% to 50%",
        "From 61% to 2%",
        "It increases ASR"
      ],
      "correct": 2,
      "explanation": ""
    },
    {
      "stage": "post",
      "question": "How does MSJ interact with PAIR (Lesson 12)?",
      "options": [
        "MSJ composes with PAIR; using PAIR to find an attack structure and then filling it with many shots can reach higher ASR than either alone",
        "PAIR neutralizes MSJ",
        "They are mutually exclusive",
        "PAIR only works on closed-source models"
      ],
      "correct": 0,
      "explanation": ""
    }
  ]
}