The "Jailbreak Paradox" paper proves two structural impossibility theorems for jailbreak detection and supports them with Tamil black-box experiments

The paper proves two impossibility results about jailbreak detection at the structural level: no perfect classifier exists—if one assumes a strongest model immune to jailbreaks, constructing a composite of it with a perfect classifier would be stronger, leading to a contradiction; and a weak model cannot determine jailbreak inputs for a strong model, because the judge's confidence is constrained by its own capability ceiling rather than the target behavior. The authors translate three black-box methods—Albert Jailbreak, Pliny Jailbreak, and CodeJB (two-round code generation)—into Tamil and conduct empirical tests on multiple models at different language capability levels.