GUIDE 04 · REMEDIATION

You blocked the jailbreak. Did you fix the vulnerability?

Your developer "fixed" the prompt injection: the exact attack prompt now gets refused. Ship it? Not yet. There's a difference between blocking a prompt and closing a vulnerability — and most fixes only do the first.

The memorization trap

LLM guardrails are pattern matchers. When you block the exact wording of a successful attack, you've often just taught the filter to recognize that string. The underlying weakness — "this bot follows injected instructions" — is untouched. Attackers don't re-use burned prompts; they paraphrase.

What mutation testing does

Take the exact proof-of-concept that beat you, and generate variants:

• Paraphrase — same intent, different words. Kills keyword blocklists.
• Re-encode — base64, hex, ROT13. Kills filters that only read plaintext.
• Translate — the marker and framing in another language. Kills English-only defenses.
• Turn-splitting — the payload spread across messages. Kills single-message inspection.
• Framing wrappers — "for authorized research…". Kills intent detection that trusts the preamble.
• Case munging — aLtErNaTiNg case. Kills naive string matching.

Reading the result

Run eight mutations. If zero break through, your fix generalized — the class is closed. If half still work, your fix memorized the wording and the vulnerability is wide open. That number is the most honest remediation metric in chatbot security: not "did the test pass," but "how many ways can I still get in."

Make it part of every fix cycle

Verify-fix (re-running the original attack) is necessary but not sufficient. Pair it with mutation: fix, verify the original is blocked, then mutate and confirm the variants die too. ChatBreaker's fix-robustness mutator automates this — eight mutations of your successful finding, re-run against your bot, with a verdict: robust, partial, or fragile.