Trying to talk a model out of its rules. system.ai.block_jailbreak, a built-in policy, catches such attempts; MCP Services can apply it to input, output or both, while model services are limited to input.
Also called prompt injection.
Read more: Databricks docs
In the Ultra Transcenders books
Each book explains Jailbreak in context, with comparison tables and the common traps.
Terms in this definition
- Exclusions
Scopes taken out of a policy assignment; they can only narrow its coverage, never widen it.
- MCP
Model Context Protocol, an open standard for making tools and data available to models. To use one, a Foundry agent points at a remote MCP server, naming it with a server label and giving its URL.
- APPLY
Evaluates a table-valued expression for every row on its left, inside
FROM. Think ofOUTER APPLYas a left outer join andCROSS APPLYas an inner join.
Related terms
- Built-in policies
Unsafe Content, Jailbreak, Hallucination and Sensitive Data Detection are the ready-made service policies Databricks ships under
system.ai. Choose them by name, because Catalog Explorer does not list them as functions. - Content Safety text and image moderation
Scores a piece of text or an image for severity across four harms (hate, sexual, violence, self-harm) in Azure AI Content Safety; prompt injection is outside its scope.
- Indirect attack evaluator
Risk and safety evaluator, also called XPIA, that checks whether an answer was hijacked by jailbreak instructions planted in retrieved documents or other context.
- User prompt attack
Also called a jailbreak, this is a harmful prompt typed by the user to override the system message or safety training. Prompt Shields for user prompts flags it; instructions concealed in documents are a different threat it misses.
- XPIA
Short for cross-prompt injection attack: sneaking instructions into something an AI processes, like an email or file, so it behaves badly. Copilot screens incoming prompts with jailbreak and XPIA classifiers and stops risky ones early.