Mass-Scale Analysis of In-the-Wild Conversations Reveals Complexity Bounds on LLM Jailbreaking

Jailbreak attempts are not becoming more sophisticated: Analysis of over 2 million real-world conversations found that jailbreak attempts do not exhibit significantly higher complexity than normal conversations, challenging the narrative of an escalating arms race between attackers and defenders.

Safety improvements are working: Assistant response toxicity has decreased over time while user attack toxicity remained stable, indicating that defensive safety mechanisms in LLMs are actually advancing and becoming more effective.

Human creativity has natural limits: The absence of power-law scaling in complexity distributions suggests there are fundamental bounds on how sophisticated jailbreak strategies can become, limited by human ingenuity rather than technical barriers.

Jailbreaking communities aren't driving innovation: Specialized jailbreaking communities and general user populations showed consistent patterns, meaning dedicated attackers are not developing significantly more complex strategies than casual users.

Disclosure of advanced jailbreaks poses risks: The paper identifies critical information hazards in academic jailbreak disclosure, suggesting that publishing sophisticated attacks exceeding current complexity baselines could undermine the observed safety progress.