Implementation guide
OWASP AISVS v1.01
Input Validation · Prompt Injection Defenses
Detect many-shot jailbreaks
Verify that the system can detect many-shot jailbreaking patterns.
OWASP AISVS v1.01, requirement 2.1.8
In plain English
A many-shot jailbreak fills the context with dozens or hundreds of made-up question-and-answer examples in which an assistant complies with harmful requests. The model picks up the pattern and follows it. Large context windows made this practical, so your system needs a way to spot it.
What good looks like
- Inputs containing large numbers of dialogue-style examples are detected.
- Detection covers uploaded and retrieved content as well as typed messages.
- Detected attempts are blocked and logged.
- The detector is tested with attack samples of different lengths and formats.
How teams usually do it
- A structural check that counts repeated speaker-turn patterns (such as "User:" and "Assistant:" pairs) inside a single input and flags counts above a threshold.
- A classifier in front of the model that has been trained or prompted to recognise many-shot attacks, combined with the injection screening in 2.1.3.
- Tight per-input token limits (2.1.4) where the use case allows, which cap the number of examples that fit.
Suggested evidence
- Detection rules or classifier settings.
- Test results with sample many-shot attacks, including ones hidden in documents.
Common mistakes
- Relying on a length limit alone when the limit still leaves room for dozens of examples.
- Looking only for one transcript format. Attackers change the labels and layout.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.