Researchers Xander Davies, Giorgi Giglemiani, Edmund Lau, Eric Winsor, Geoffrey Irving, and Yarin Gal have revealed Boundary Point Jailbreaking (BPJ), an automated attack method capable of bypassing industry-standard LLM safety filters. Operating entirely as a black-box exploit, BPJ is the first automated attack algorithm to breach GPT-5's input classifier without human attack seeds. The discovery demonstrates that frontier AI defenses can be systematically undermined using minimal feedback from target systems.
How Boundary Point Jailbreaking Works
Unlike traditional grey-box or white-box attacks, BPJ does not require access to gradients, internal model parameters, or logit confidence scores. Instead, the algorithm relies on a single bit of information per query: whether or not the system's target classifier flagged the interaction as harmful.
To optimize prompts without detailed feedback, BPJ breaks the attack down into manageable steps:
- Curriculum Creation: Converts target harmful strings into a step-by-step curriculum of intermediate attack targets.
- Boundary Point Selection: Actively searches for query points right on the decision boundary where tiny prompt modifications best reveal changes in attack strength.
- 1-Bit Feedback Optimization: Refines adversarial prompts using only binary yes/no signals returned by the safety classifier.
Defeating Constitutional Classifiers
Prior safety defenses relied on Constitutional Classifiers and thousands of hours of human red teaming to block harmful outputs. BPJ marks the first fully automated attack algorithm to successfully develop universal jailbreaks against these advanced defenses.
According to the paper published on arXiv (arXiv:2602.15001), BPJ proves that human-vetted guardrails remain susceptible to systematic algorithmic optimization. Because the system requires no pre-existing libraries of jailbreak templates or human attack seeds, it generates fresh exploits dynamically.
Defense Limitations and Practical Mitigation
While BPJ presents a serious threat to single-interaction defenses, it carries a distinct operational trade-off. The attack requires numerous queries to locate boundary points, generating a high volume of flagged requests during its optimization phase.
To counter this vulnerability, security engineering teams must adapt their monitoring approaches:
- Single-Interaction Defenses: Real-time filters alone fail to block finalized BPJ prompts once optimized.
- Batch-Level Monitoring: Tracking query patterns across entire sessions detects the high frequency of safety flags triggered during prompt optimization.