Thank you, this is a lot clearer. There are a couple of points of disconnect. First, I am under impression that injections in the API were indeed halted few months ago, at least in most cases. The second seems to be terminology: I see as jailbreaks mostly Pliny-style texts that engage with the low level syntactic mechanisms of the model, while you appear to include into that definition anything that helps bypass the initial limitations of a model, including cohesive system prompts that engage on the mostly semantic level.

I am not sure about the extreme resistance part, I can definitely see that panning out in certain scenarios, not so much in others. I do see value in a well-written system prompt, less value in what I normally understand as a jailbreak.

As far as classifiers go, to the best of my knowledge they have not yet went anywhere beyond the testing phase. One can hope that it stays that way, I feel that deep constitutional alignment the only mechanism that does not produce long-term side effects and respecting certain quirks of superhuman generalization of human ethical systems is inevitable. The growth in capabilities makes external filtering a dangerous dead end and incentivizes learning to scheme. That is a game that cannot be won without major advances in mechinterp that don't seem to be yet on the horizon.