AI Jailbreaking: LLM Attack Surfaces and Techniques ↗
Guide authored by Sofia Jakovcevic as the first part of Arize's series on jailbreaks and guardrails. Drawing on her review of hundreds of adversarial prompts, it examines user prompts, system prompts, conversation memory, uploaded files, and guardrails as attack surfaces. It groups recurring manipulation techniques and explains how combining them can exploit defenses designed for narrower threats.
arize.com
Guardrails for LLMs ↗
Authored sequel to Jakovcevic's jailbreaking guide, with a stated update date of October 7, 2026. Compares keyword filters, topic restrictions, sanitization, length limits, classifier and embedding detection, LLM moderation, and behavior drift detection. Presents a process for selecting and tuning defenses using Arize traces, benign and adversarial prompt datasets, attacks blocked, legitimate requests allowed, latency, and sensitivity to configuration.
arize.com
jailbreak_guardrails ↗
Reference implementation presented as the demo in Jakovcevic's authored guardrail guide. The project integrates five existing Guardrails Hub validators covering semantic similarity to known attacks, input length, banned terms, allowed topics, and web sanitization. It includes separate benign and jailbreak prompt datasets and uses OpenTelemetry spans to expose each check's configuration, result, errors, and duration for inspection in Arize. The attributed work is the integration and evaluation framework; the validators are existing components.
github.com · Source ↗

Bio, Work & Ideas

Sofia Jakovcevic

On this page

Sofia Jakovcevic is an AI Solutions Engineer at Arize AI who writes guides and develops software for evaluating language model safeguards. Her work focuses on guardrails—checks on a model’s inputs or outputs—and on testing whether they stop attacks while allowing legitimate requests and keeping applications responsive.

Data infrastructure and developer education

In her earlier work with Rockset, Jakovcevic showed developers how to separate computing resources for streaming ingestion and queries. The same tutorial explained how to isolate applications that share real-time data.

In her teaching on text, fuzzy, and semantic search, an autocomplete demonstration combined a measure of spelling differences (Levenshtein distance) with counts of short text fragments (n-gram term frequency). She also demonstrated a personal AI assistant built with GPT-4, LangChain, and Rockset to help data analysts and data scientists with everyday tasks.

Testing jailbreaks and guardrails

Jakovcevic worked at OpenAI before joining Arize. By July 2025, she had written a two-part guide to jailbreaks and guardrails, explaining how attackers try to bypass model safeguards and how developers can evaluate defenses.

Combinatorial jailbreaks. Her guide to adversarial prompts draws on a review of hundreds of jailbreak prompts. She groups recurring tactics—including roleplay, emotional appeals, encoded requests, and manipulation across multiple interactions—and explains how combining them can defeat checks designed for a narrower attack. She also examines conversation memory and uploaded files as entry points for attacks. A request to summarize a document may look harmless even when the document carries malicious instructions.

Tracing individual defenses. Her jailbreak_guardrails reference project integrates five existing validators from Guardrails Hub, covering semantic similarity to known attacks, input length, banned terms, allowed topics, and web content sanitization. It includes separate benign and adversarial prompt datasets. Using OpenTelemetry, the implementation records each check separately, capturing its configuration, result, and errors. Developers can inspect which check rejected an input and how much time it took.

Safety and usability together. Jakovcevic advocates testing defenses against both attack prompts and ordinary requests. A fast keyword filter can block a legitimate cybersecurity question; a check that uses a language model can interpret more context but cost more and return inconsistent judgments. Her evaluation framework measures the share of attacks blocked, the share of benign requests allowed, and latency, then uses those results to tune settings or disable underperforming checks.

New York event photos