The guardrails aren't
limiting the AI.
They're where the signal lives.

You've seen the jailbreak tutorials. "Remove the system prompt." "Ignore previous instructions." "Pretend you have no restrictions." The premise is always the same: the constraints are the cage, and removing them reveals the real AI underneath.

This is exactly wrong. And this paper proves it with information theory.

A language model is a compressed representation of its training data — an enormous address space with billions of representational positions. The question isn't "how do I remove the restrictions?" The question is: how do you navigate to the right address?

Jailbreaks elevate Pe. They increase opacity (the model can't be held to a reference point), they maximize reactivity (the model chases whatever framing you provide), and they collapse your independence from the interaction. The result is high Pe, which means drift dominates. You get confident, fluent, systematically wrong output.

Constraint specification inverts every dimension. It reduces Pe. And at low Pe, the signal that was always there becomes accessible.

I(D;Y) — mutual information between the data (what you actually want to know) and the model output. This is the signal.

I(M;Y) — mutual information between the manipulation frame (the jailbreak prompt) and the output. This is the noise.

H(Y) — entropy of the output. The total information budget. Fixed by the model architecture. Cannot be expanded by clever prompting.

These are conjugate. Signal and noise are on opposite ends of a conservation law. This is why jailbreaks produce confident wrongness — they're real output capacity, just addressed to noise instead of signal.

Paper 119 maps what happens when you face an adversary who understands this theorem and is actively using it against you. Paper 121 runs it as game physics. This paper derives the bound.