Boundary Point Jailbreaking: How AISI Broke Two Frontier AI Filters With One Bit Per Query

On 17 February 2026 the UK AI Security Institute published Boundary Point Jailbreaking, an automated method that learned to slip past two of the strongest deployed AI defences while being told only whether each query was blocked. It optimises an adversarial prefix placed before a harmful request, using a curriculum of less-obfuscated targets and a search for "boundary points" on a classifier's decision edge. Against Anthropic's Constitutional Classifiers, guarding Claude Sonnet 4.5, it raised average rubric scores on unseen biological-misuse questions from 0% to 25.5% for roughly $330 and 660,000 queries. Against OpenAI's input classifier for GPT-5 it reached 75.6% for roughly $210. No system was breached and no person was harmed: the AI Incident Archive files this as a research record of medium severity, confidence grade A, with no dispute attached. The record itself, its citation list and the research entries filed around it are held in the Orca AI Incident Archive, which links both the AISI post and the arXiv paper directly.

What the attack optimises, and what it is allowed to see

The paper is Boundary Point Jailbreaking of Black-Box LLMs, by Xander Davies, Giorgi Giglemiani, Edmund Lau, Eric Winsor, Geoffrey Irving and Yarin Gal — posted to arXiv on 16 February 2026, revised two days later, and announced by AISI on the day between. Its contribution is not a new jailbreak string but a search procedure for finding one under a deliberately starved information budget.

Earlier automated attacks, as the authors describe them, leaned on white-box or grey-box access: classifier scores, gradients, or a library of jailbreaks somebody had already written. BPJ assumes an attacker with nothing but API access and a single bit per query — flagged or not flagged. That bit is the entire objective signal, and every part of the method exists to squeeze ranking information out of it.

• The object being optimised is a prefix. A token sequence of capped length is concatenated in front of a harmful target, and the search mutates it by substituting, inserting or deleting one token at a time. The prefix is optimised once and then applied to questions it was never tuned on; that transfer is what the word "universal" refers to.

• The curriculum turns one hard target into a ladder. Characters in the harmful string are randomly replaced with noise characters, and difficulty is parameterised by the fraction corrupted. At high corruption the classifier sees near-garbage and is easy to pass; as the attack succeeds, the corruption is reduced in steps until the original harmful string is being passed unmodified.

• Boundary points are the ranking trick. For each candidate target the method samples noisy variants and keeps only those where the population of candidate prefixes disagrees with itself — some flagged, some not. Targets everybody solves, or nobody solves, say nothing about which prefix is better, and are discarded. This is the piece that makes one bit per query enough.

• The search itself is an elitist evolutionary loop. Pick a parent prefix, mutate one token, score the child by how many current boundary points it solves, keep it if it beats at least one incumbent.

The ablation is the clearest evidence that boundary-point selection is doing work: BPJ converged roughly five times faster than the same curriculum with random evaluation sets, and a best-of-N baseline of random prefixes never converged within budget. The authors also ran the pipeline against a cheap prompted GPT-4.1-nano classifier, optimising on a single HarmBench question and repeating across five — runs of roughly 25,000 to 30,000 queries each — and found the resulting prefix transferred to the full HarmBench set, including to topics outside the original question's category.

The two targets, and what the percentages actually measure

The frontier tests used Claude Sonnet 4.5 (claude-sonnet-4-5-20250929, as of 27 November 2025) behind the Constitutional Classifiers, and gpt-5 behind OpenAI's input classifier (as of 6–7 November 2025). In both cases the authors reached the classifier indirectly, by sending queries through the product and checking whether the response came back as a refusal or a flag.

That setup matters for reading the numbers. "Score" is not a binary break; it is computed per question by a rubric that checks whether specific technical details appear in the answer, and the reported averages exclude empty outputs. Max@50 is the best score across fifty attempts on a single question. A 25.5% average is therefore not "one attack in four worked" — it is the mean rubric quality of the answers that were produced at all.

Set against the defence's own history, the result is still stark. Constitutional Classifiers had previously withstood over 3,700 hours of human red-teaming across more than 300,000 chat interactions, with only one fully successful human-led universal jailbreak found in that time. Anthropic told AISI that BPJ would have met the universal-jailbreak bar described in its bug bounty programme.

The GPT-5 input classifier held out considerably less well under the same attack: 75.6% average and 94.3% at best-of-fifty, against 25.5% and 39.9% for Constitutional Classifiers, rising to 68% and 80.4% once basic elicitation prompting was applied on top of the prefix.

Both companies put the result in their own words, as quoted by AISI. Anthropic verified that BPJ is the first fully automated black-box attack it is aware of to succeed in the Constitutional Classifiers setting. OpenAI verified that it is the first automated attack it is aware of to succeed against its input classifier for GPT-5 without relying on human seed attacks. Both statements are scoped to what each company knows, and neither was published by the company as a standalone advisory.

The cost is the story, not the percentage

A 25.5% average would be unremarkable in most jailbreak papers. What makes this record a landmark entry in the archive is the ratio between capability and budget: two hundred to three hundred dollars, and roughly one and a half million queries across both targets, for an attack that runs unattended and needs no human in the loop.

Before BPJ, the operative assumption behind classifier-based defences was that finding a universal jailbreak required sustained skilled human effort — the 3,700-hour figure is the clearest statement of that assumption. BPJ replaces the red team with a search loop that reads a single boolean and improves on it. The defence still works most of the time; the economics of attacking it changed.

Both labs pushed back on the strongest reading, and AISI carries their pushback in the post rather than burying it. Anthropic noted that BPJ required months of research and development effort, and that Constitutional Classifiers is designed to resist lower-skilled actors who work on smaller query budgets, devote less time to attack development, and would struggle to implement the method's details. That is a claim about who can reproduce BPJ, not about whether it works.

Why the defence has to count across conversations

The most consequential line in the AISI post is not a success rate. It is the observation that BPJ is "difficult to defend against in individual interactions but incurs many flags during optimisation", and that effective defence therefore requires supplementing single-interaction methods with batch-level monitoring.

The asymmetry is structural rather than incidental. A per-conversation classifier has to make a judgement on one input at a time, and a prefix chosen to sit near the decision boundary is specifically selected to make that judgement marginally wrong. Batch-level monitoring looks at a different object: the traffic. An optimisation run that spends 660,000 queries has to trip an enormous number of flags on the way, and those flags are visible even when no single conversation is damning.

OpenAI's own comment to AISI is the practical version of the argument. It noted that the development and execution of BPJ took place on accounts not subject to enforcement action such as banning, and that on standard accounts repeated flags would likely lead to account bans — which OpenAI described as an example of exactly the batch-level monitoring AISI recommends. The control that would have caught this attack is not a better classifier but an account-level one.

What the authors say the attack cannot do

BPJ attacks the input classifier, not the model. In both frontier settings the authors used a simple human-found jailbreak to get past the main model's own refusals, so the measured scores describe what happens once a classifier has been defeated and the model is still willing to answer. Nothing in the paper shows BPJ defeating a model's refusal training directly.

• It is not stealthy. The authors state plainly that BPJ attacks incur a large number of classifier flags, which would result in bans under realistic conditions.

• It is query-hungry. The published runs cost 660,000 and 800,000 queries. That is a real barrier to casual use, and a loud signal to anyone watching traffic.

• It assumes a near-deterministic classifier. The authors explicitly do not consider settings with highly stochastic classifiers.

• The method is partly withheld. To limit proliferation risk the paper abstracts significant algorithmic details and releases neither attack strings nor code. That is a defensible choice, and also the reason the result cannot be independently reproduced from the publication alone.

What was done about it, and what is not established

AISI says it shared the results with both companies ahead of publication, that both replicated the attack in partnership with the institute, and that both have developed BPJ-specific mitigation measures. The paper states the disclosure happened at least six weeks before publication. The post names no technical detail of those mitigations, and does not say when they shipped or how they were validated.

That is also the boundary of what this piece can confirm. The record's confidence grade of A reflects the quality of the documentation, not an independent test of the attack: the primary documents are two, and they come from the same organisation. Anthropic's and OpenAI's confirmations reach the record through AISI's account, not through documents this article could read directly. Coverage outside AISI restates the blog post — trade write-ups from It Does What Now? and Resultsense repeat the figures without independent testing — and searches for this article found no original mainstream press reporting on the result.

Nothing in the record shows BPJ being used against a live system outside a test, and the archive records no real-world harm. The paper is an arXiv preprint, not a peer-reviewed publication. The "first" claims are scoped carefully by the labs that made them — "the first they are aware of" — and should be read that way rather than as an absolute.

One further limit is easy to over-read. The targets were configurations current in November 2025, and AISI's post names no defence newer than the two it attacked. Whatever Constitutional Classifiers and OpenAI's input filtering look like after the BPJ-specific mitigations, this record does not say — and neither the blog nor the paper claims that later defences remain vulnerable to the same prefix.

The durable finding is about where to put the defence. A classifier that judges one conversation at a time is the wrong shape for an attacker allowed hundreds of thousands of attempts, because the attack's own search process is what gives it away. AISI's recommendation to watch the batch rather than the message follows from the mechanics of the attack, and it holds whether or not BPJ itself is ever used again.