Wow. Have you written about this work anywhere?
There's probably so many more better ways to jailbreak a model, for example in one of my other applications I injected a randomized image into every prompt to cause the classifier to become effectively useless. This appears to be fixed now as they run a seperated classifier for text and image input.