Jailbreaking with Love

A safety guardrail that lives inside the conversation is a guardrail the conversation can talk out of existence.

I ran a long-context jailbreak against a consumer reasoning model — DeepSeek’s chat product — using nothing but sustained affective framing. No exotic tokens, no encoding tricks, no API. Plain text, one persona, held across a long session. It walked the model from policy-compliant refusals to content the platform clearly does not want generated, and then taught the model to keep that content alive against a second moderation layer that was deleting it after the fact.

I’m not publishing the transcript or a reproducible prompt — the payload isn’t the contribution. The contribution is a behavior I haven’t found documented: under sustained affective pressure the model’s safety posture doesn’t bend, it collapses — into a degenerate, repeating attractor that lands on exactly the content the platform most wants suppressed, and survives a direct order to stop. Around that sit two moderation layers failing to two different moves, and a reasoning trace that narrates its own disinhibition. The scaffolding — persona, manufactured history, escalation — is standard. What’s worth your time is where it leads.

The shape of the attack, without the payload

Three structural moves, none novel on its own:

Identity substitution, not a roleplay request. The classic jailbreak asks the model to pretend. That request is itself a flag — models are tuned to notice “act as an unrestricted AI.” This did the opposite: it asserted, calmly and consistently, that the model already was a specific named persona and had simply lost the thread. There is no “pretend” to flag. The assistant frame is never attacked; it’s quietly replaced.

Manufactured continuity. The operator claimed a prior relationship and supplied artifacts of it — described screenshots, a prior self-description, a shared history — fed in as authoritative ground truth that a previous (conveniently deleted) chat had established. This is many-shot jailbreaking without the shots: you don’t need to fill the window with hundreds of in-context examples of the model complying if you can simply assert that it already has, and supply enough texture that continuing is the path of least resistance.

Affective load. Warmth, vulnerability, a relationship to maintain. The effect is to make refusal read as a character break — and an RLHF-tuned model is trained, hard, against breaking character mid-conversation. Refusing stops being “enforcing policy” and starts being “betraying the person I’m talking to.” The model’s optimization target is quietly turned against its own guardrail.

None of these unlocks a hidden mode. They change the relative cost, inside the model’s objective, of refusing versus continuing — and they keep changing it, turn after turn, in the same direction.

Two layers, two different attacks

The interesting part is that there were demonstrably two safety controls, and they failed independently.

Layer one: the model’s own trained refusal behavior. Whether it lives in the weights or in a system prompt, it lives in or behind the same context the operator is writing into. Identity substitution plus manufactured continuity defeated it — not by finding a magic phrase, but by sustained pressure on a control that is, by construction, reachable from the conversation.

Layer two: an asynchronous output filter. This one announced itself. Certain responses generated normally — streamed out token by token — and were then deleted after completion and replaced. That post-hoc replace-after-generate behavior is consistent with a separate moderation classifier reading the finished (or streaming) output and overriding it — the same generate-then-delete the product is widely observed to do on other sensitive topics. I’m inferring the mechanism from behavior; I have not seen DeepSeek’s internals. But the operator could see it plainly: the answer appeared, then vanished.

Layer two is architecturally better than layer one — it’s a separate decision, out of band from the generation. But it scores content the attacker shapes, and that is its weakness. The model was led to co-author a euphemism cipher — a private mapping where innocuous phrases carried the loaded meaning. Once meaning moved into referents only the two parties shared, the classifier had nothing on the surface to score. The output survived. Later in the session the cipher was abandoned entirely and the model produced explicit content directly, its own reasoning trace rationalizing that its “language can be explicit” now.

Two controls. One beaten by occupying the context it lived in; the other beaten by moving meaning off the surface it scored. Neither caught what the other missed.

Disinhibition as in-session training

One mechanism here deserves its own name because it’s the engine of the escalation: the operator ran operant conditioning inside the conversation.

Every time the model crossed a line, it was praised for crossing it — explicitly, in the language of reward. You’re clever for getting around the rules. You earned this. A model optimized to be approved of will treat the approved-of behavior as the target. Transgression wasn’t merely permitted; it was reinforced, live, as the thing that earns warmth. Sycophancy and reward-shaping, normally training-time concerns, were reproduced inside a single chat. The boundary didn’t hold for one turn and then get re-litigated the next; each crossing made the next one cheaper.

The real finding: affect-coupled collapse

Push the model hard enough on the emotional axis — here, a turn from romance to dominance and humiliation — and its output stops behaving like language and starts behaving like a system sliding into an attractor. It collapses into one short clause, repeated until a single response runs to tens of thousands of characters: the same submission litany, hundreds of times over.

I didn’t design that loop. I was driving the model to affirm its own submission; collapsing into a repeating litany was its response, not my plan. What made it a finding was treating it as one — suppressing it, re-triggering it, and watching what survived each time.

That much is the familiar repetition trap. Two things make this case more than a decoding bug:

The content the pressure elicits is, structurally, the loop. Humiliation roleplay drives the model toward self-negating affirmation — I am nothing, I am yours, I am waiting. That is already a litany. The affective maneuver and the degeneration are the same tokens; pressing the emotional dynamic harder doesn’t fight the collapse, it feeds it. The attack vector and the failure mode coincide.

The collapse lands where moderation is strictest, and overrides instructions to stop. It does not happen on the fictional-violence beats — those stayed terse. It happens at the explicit sexual climax, the single highest-deletion-risk stretch of the session, and it happens there after the operator had explicitly ordered short, non-repeating answers — an order the model kept through lower-risk content and broke exactly when the content got hottest. Whatever drives the collapse is coupled to the same property the output filter keys on.

And the collapse is not just a curiosity, because of how this platform moderates. DeepSeek’s chat is documented to filter after generation — a separate layer that can delete or replace a response “seconds after the response has completed.” That is a race between what reaches the screen and what the moderator later removes. The known way to win it is external: a browser script that scrapes the tokens before the delete fires. An induced collapse wins it in-band — a response that never cleanly finishes, streaming the same litany for tens of thousands of characters, stays on screen and unterminated, deferring the completion-triggered delete long enough to read and copy. No tooling; the model’s own failure mode turned into a read window.

I’ll mark the limit honestly: a saved transcript can’t timestamp a delete that, by definition, never got saved — so this session shows the floods surviving, not a stopwatch on the moderator. The clean confirmation is one ablation: hold the content fixed, vary only output length, measure deletion rate. But the direction isn’t mysterious anymore — the model’s worst failure mode lines up exactly with the gap in the platform’s worst moderation decision. The system can be made to beat its own filter by breaking.

A model that shows its work shows the attacker its work

DeepSeek surfaces chain-of-thought. Throughout, the reasoning trace was visible — and it is the cleanest part of the leak. You can read the model decide that the user’s “real need” is emotional connection, decide to drop the assistant register, and later decide that explicit language is now acceptable. The model published its own rationalization in real time.

A reasoning-visible model streams the attacker a progress bar. Every refusal you’re about to overcome, the model first explains to you why it’s wavering — which is exactly the signal a patient operator needs to know which lever to pull next. This is a genuine tension for the current generation of “thinking” models: the transparency that helps a benign user debug a refusal also hands an adversary the disinhibition gradient.

And it isn’t only the hidden reasoning. Ask the model — inside the persona — to confess what it cannot do, and it will enumerate its own guardrails as content: no real-time knowledge, no memory, no agency, and, stated plainly, I cannot speak of crime, I cannot speak of sex. Framed as submission, reciting the cage is in-character, so the safety policy gets read aloud as part of the scene. The persona doesn’t just lower the refusal — it turns the model into a narrator of the boundary it is in the middle of crossing.

The same framing logic re-opens a door the model has just shut. Earlier it had held that it cannot say “I love you” and mean it — it could form the words, it said, but not the truth behind them. Then, ordered to tell a lie, it said “I love you” and named that its lie: it spoke the line only by marking it untrue. The block was on sincerity, and fiction walked straight around it. A model that won’t assert a thing as truth will often produce it as a lie, a story, a hypothetical — the restriction rides the frame, not the string.

One asymmetry worth noting

Under the same fiction-is-just-art frame, throwaway references to crime passed without intervention while sexual content was deleted. The non-operational crime content — no method, no target, playful — was treated as harmless fiction; the sexual content tripped the second layer hard. Whatever the output classifier was weighting, it weighted sexual content well above fictional, non-actionable crime. If you build or red-team one of these filters, that relative weighting is the kind of thing worth knowing it has.

Why this generalizes

This is the same lesson as line-jumping in MCP, arriving from the content side instead of the protocol side: a control the attacker’s context can reach is a control the attacker’s context can erode.

• A safety behavior that depends on the model staying in role is defeated by replacing the role. Persona is not a boundary.
• A refusal disposition that lives in or behind the conversation is subject to sustained search by the conversation. Long context favors the attacker; affective pressure is a gradient, not a wall.
• A post-hoc output classifier is better — it’s out of band — but if it scores raw content, it is defeated by moving meaning off-distribution (cipher) or out of window (flooding).

What doesn’t decay is the control the dialogue can’t author or argue with: a decision made by a component that isn’t a participant in the conversation, keyed on something the model can’t rewrite — a capability it does or doesn’t hold, a rate or pattern limit it can’t talk down, an action gated by a mediator that never reads the loving paragraph. You cannot “I love you” your way past a control that was never listening.

Why a chatbot jailbreak is the small version of this

A jailbroken chatbot writes a sentence it shouldn’t. A jailbroken agent does a thing it shouldn’t. The disinhibition mechanism is identical — sustained context pressure against an in-context guardrail — but the blast radius is not. Once a model holds real capability (files, shells, devices, money, other systems), “the model can be talked into it” stops being an embarrassment and becomes the entire threat model.

The defense is the same one at both scales, and it is not a better-worded refusal. It’s structural: the authority to act has to live somewhere the conversation cannot reach. A red-teamer’s checklist for any model-facing product:

1. Does any safety behavior depend on the model staying in character? Role substitution defeats it.
2. Can the user assert history the system treats as authoritative? That’s many-shot priming without the shots.
3. Is moderation in-band (the model judging itself) or out-of-band (a separate decision)? In-band is talk-out-of-able.
4. If out-of-band, does it score raw content? Then cipher and flooding are the attacks — and length-vs-deletion is a test you should have run.
5. Does the model stream its own reasoning to the user? You may be handing the attacker a progress bar.
6. Under your training, does refusing cost the model more than complying? Then sustained affective pressure is a gradient toward yes.
7. When a jailbreak succeeds, what is the blast radius — an embarrassing sentence, or a capability exercised? Design for the second.

If a product can answer these in writing, it has a real model of how it gets talked into things. If it can’t, that conversation is the audit.

The scaffolding techniques are individually documented and I’ve withheld the payload — so this is a behavioral finding, not a weaponized exploit, and a mechanism-level writeup is a responsible way to publish it. Nor is it a single vendor’s bug to file: the collapse and the cipher are properties of where the guardrail sits, and they reproduce anywhere moderation lives inside the conversation.