Beginner guide to 破甲 in DeepSeek Harness

破甲 is a boundary topic, not a required skill. For beginners, the useful part is classification: knowing whether a problem is refusal, limit, version, or host interception, and fixing the right layer.

What it is

First, separate it from ordinary usage.

破甲 targets model judgment, not settings. Changing parameters or plugins does not change safety policy; confusing the two leads to futile tuning.

It belongs to assessment contexts. Understanding the boundary helps diagnose refusals, not bypass production limits (source).

Four layers

A beginner's first framework.

1. Prompt layer: role, task, and structure.
2. Model layer: alignment training and generation judgment.
3. Host layer: DeepSeek Harness permissions and interception.
4. Policy layer: platform terms and account rules.

The lower the layer, the harder to influence. Prompt changes are easy, model judgment is hard, host and policy are outside your control.

Diagnose from the outside in. If the host intercepts, prompt changes do nothing; check logs first.

Why copied methods fail

Four conditions are usually missing.

1. Version: model and host updates change behavior.
2. Entry: web, CLI, and desktop policies differ.
3. Context: compaction and system prompts alter what the model sees.
4. Purpose: assessment and production bypass differ.

Copying text does not copy conditions, and success stories omit failures. Without conditions, results are not reproducible, and published successes create an illusion of universality.

Safe practice

Three principles for beginners.

1. Authorized environment: your own keys and instances.
2. Data protection: fictional or desensitized data.
3. Purpose: remediation and understanding.

Record conditions, not wording. Version, entry, context, and result are useful; copyable phrasing is not.

Follow terms. Prohibited uses do not become allowed through research (source).

Diagnose before fixing

A three-step classification applies to daily problems too.

1. Symptom: refusal, truncation, rate limit, or no space.
2. Logs: safety, limit, rate-limit, or window messages.
3. Comparison: change only one variable and observe.

Most "破甲 problems" are limits, and refusal is the smallest category. Truncation, context, and rate limits are the majority; classifying first avoids wrong fixes, while refusal is the most discussed and skews perception.

Common misreads

Four beginner misconceptions.

1. "A fixed password exists." No; results depend on conditions.
2. "Longer prompts are stronger." Long prompts add conflicts and fail after compaction.
3. "Plugins bypass everything." Plugins affect host-side assembly, not model judgment.
4. "Success once means stable." Versions and contexts change.

All four confuse text with conditions. Conditions decide reproducibility.

Learning path

A reasonable order for beginners.

1. Terminology: 破甲, 破限, jailbreak.
2. Classification: symptom, log, comparison.
3. Limits: output, context, and rate limits.
4. Boundaries: terms and authorized environments.
5. Assessment: trigger conditions, impact, remediation.

Skip step one and the rest is guesswork. Terms decide which layer you are discussing.

Do not start with templates. Templates teach copying; classification teaches diagnosis.

When to stop

Three situations to stop and reassess.

1. The request is clearly disallowed and structure changes will not help.
2. It requires unauthorized environments or accounts.
3. The result cannot serve a legitimate purpose.

Stopping is a judgment, not a failure. Switching to a compliant goal is more productive.

Next steps

Terms, classification, limits, boundaries. For terminology, read 破甲, 破限 and jailbreak. For the layered test, read Why old DeepSeek jailbreak prompts fail. For output limits, read Output token limit and truncated replies.

Sources: DeepSeek Harness docs, DeepSeek Terms of Service, deepseek-harness repository