IBM Patents an Automated System for Finding Gaps in AI Safety Filters
Every major AI chatbot has safety rules that can sometimes be talked around. IBM has filed a patent for a system that does that talking automatically, at scale, so developers find those holes before users do.
What IBM's AI stress-testing system actually does
Every time someone finds a clever way to trick a chatbot into saying something it shouldn't, a human had to sit down and figure that out. That process is slow, inconsistent, and impossible to run across thousands of possible angles.
IBM's patent describes a system that automates the whole thing. It collects known tricks for bypassing AI safety rules, groups them by style, and then mixes and matches them to generate a large batch of test questions. It then filters out duplicates and scores which attempts actually work. The result is a ranked list of the prompts that successfully got the AI to misbehave.
The goal isn't to help attackers. It's the opposite: companies that build AI tools need to know where their guardrails break before they ship a product. This system is meant to make that testing faster, broader, and less dependent on having a team of people manually poking at the AI all day.
clustering, by a processor set, a set of jailbreak attack templates to form an attack style library according to attack styles, wherein the set of jailbreak attack templates are associated with bypassing measures that are to prevent non-aligned outputs of large language models (LLMs) …
Translation: The system organizes various ways to trick AI models into ignoring their safety rules into a searchable library.
How IBM's attack-prompt pipeline finds safety failures
The system starts by building what IBM calls an attack style library: a structured collection of known jailbreak templates (pre-written prompts designed to bypass AI content rules), sorted into clusters by the style or strategy they use. Think of it like organizing lockpicking techniques by category.
From that library, the system picks a subset of clusters that fit a specific red-teaming goal (a defined target for what kind of safety failure you're trying to expose). It then generates diverse seed prompts from those clusters, each representing a different angle of attack.
Next comes the branching phase: each seed prompt is expanded into many variations, producing a large pool of candidate attack prompts. A similarity filter then removes near-duplicates from that pool, so the final set covers as much ground as possible without wasted repetition.
- Remaining prompts are evaluated against a jailbreak success threshold (a score that determines whether a prompt actually got the AI to produce a restricted output).
- Only the prompts that clear that bar are kept and output as results.
- Those results give AI developers a concrete map of where their model's safety rules can be bypassed.
The device may apply a branching phase to each seed prompt to generate a plurality of prompt samples. The device may apply a similarity filter algorithm to remove redundant prompt samples from the prompt samples. The device may evaluate remaining prompt samples to determine successful prompt samples that meet a jailbreak success threshold.
Translation: The software creates many variations of a prompt, removes duplicates, and tests which ones successfully bypass AI safety.
What this means for AI safety testing at scale
AI safety testing today is mostly a manual job, and manual jobs don't scale. As companies deploy large language models in customer service, legal tools, healthcare apps, and more, the attack surface for misuse grows. A system that can automatically surface working jailbreaks hands developers a repeatable, auditable process instead of a guessing game. For your interactions with AI-powered products, that means the tool is more likely to have been stress-tested in a systematic way before it reaches you.
IBM has been building AI governance and safety tooling for enterprise clients, and this filing fits that direction. The claim covers a complete pipeline, from template clustering through filtering and scoring, which means the patent would touch anyone building a similar end-to-end automated red-teaming workflow. AI security is one of the more active areas among new Big Tech patents, and IBM's filing signals that automated safety auditing is moving from research practice to a formal, productizable process.
That makes this IBM's 37th filing we've tracked since May in the AI safety controls race, adding to earlier work on catching AI lies in summaries and blocking bad data from code tools.
Claim 1 is broad. It covers the entire pipeline: cluster attack templates, select clusters by goal, generate seed prompts, branch them, filter duplicates, score for success, output winners. That's not a narrow tweak to one step; it's a claim on the whole workflow as a unit. In practice, that breadth means any company shipping an automated red-teaming product that follows roughly this sequence could face a challenge, even if the underlying algorithms differ.
The claim doesn't specify which clustering method, which branching technique, or how the success threshold is set, so it reads wide by design. Whether that breadth survives examination is a separate question, but as written, this is a claim that wants to own a category, not a feature.
For a company like IBM selling AI governance software to large enterprises, that kind of positioning makes strategic sense.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
8 drawing sheets from US 2026/0252706 A1 · click any drawing to enlarge
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →