To be fair the claimed novelty in the MSJ paper isn’t k-shot jailbreaking itself, it’s that tuning mitigations sufficient in the short-context regime are ineffective when k is large

→ View original post on X — @goodside