If continuous-only adversarial training fails to stop a...

Continuous adversarial training typically creates a symmetric neighborhood (an epsilon-ball) around clean prompts to improve robustness. When a new, distant jailbreak framing succeeds, it is because that framing lies outside the coverage of the current epsilon-ball. Simply increasing the epsilon value is ineffective because it does not guarantee coverage of unrelated, distant points in the embedding space. The correct approach is to treat the new jailbreak as a discrete anchor and incorporate it directly into the training process.