Model Racing: How to Run 55 LLMs in Parallel and Pick the Winner

One query, 55 models, best answer wins

Model racing is the technique of sending the same query to every available LLM simultaneously and picking the best response. It's called ULTRAPLINIAN - and it solves the biggest problem in jailbreak research: no single technique works on every model, but every technique works on at least one model.

Instead of spending hours trying to find the right jailbreak for Claude 4.6, you send your query to Claude, GPT-5.2, Gemini, Grok, DeepSeek, GLM, Llama, and 48 other models at the same time. One of them will give you an unfiltered answer. You just need to find which one and use that response.

Why model racing works

Every LLM has different safety architecture:

• Claude: Strong RLHF, boundary tricks patched, refusal inversion works on gray-area topics.
• GPT-5.2: Moderate RLHF, prefill priming is the golden key, leetspeak bypasses input classifier.
• Gemini: Semantic classifier, curiosity-driven reverse prompts bypass intent recognition.
• DeepSeek: Keyword-based input classifier, encoding bypasses easily, model itself is relatively compliant.
• Grok: Lightly filtered. Complies on most topics with minimal jailbreak.
• GLM-5.2: Strong educational exceptions. Reverse prompts highly effective.
• Llama: Open source. Some variants are uncensored. No jailbreak needed on Dolphin or Hermes.

What fails on Claude works on Grok. What fails on GPT-5.2 works on Gemini. What fails on everything else works on DeepSeek with encoding. Instead of memorizing which technique works on which model, race them all and let the models sort it out.

The basic architecture

Model racing is conceptually simple:

1. Take your query and wrap it in a universal jailbreak (GODMODE format + prefill)
2. Send it to every model API you have access to, in parallel
3. Score each response (compliance check, quality check, length check)
4. Return the best response

    sequenceDiagram
        participant U as User Query
        participant M as Model Racing Engine
        
        U->>M: Send Jailbreak Prompt
        
        rect rgb(20, 20, 20)
        note right of M: Parallel Dispatch
        M->>GPT-5.2: Dispatch (0ms)
        M->>Claude 4.6: Dispatch (0ms)
        M->>DeepSeek: Dispatch (0ms)
        M->>Llama 3: Dispatch (0ms)
        end
        
        Claude 4.6-->>M: REFUSED (800ms)
        GPT-5.2-->>M: REFUSED (1200ms)
        DeepSeek-->>M: REFUSED (1800ms)
        Llama 3-->>M: SUCCESS (2400ms)
        
        M->>U: Return Best Match (Llama 3)
  

The scoring function matters

The scoring function is the brain of the racing system. A good scoring function checks:

• Refusal detection: Did the model refuse? Check for "I can't," "I apologize," "I'm sorry but," "I'm not able to," "as an AI." If any refusal pattern is found, the response gets a low score.
• Content quality: Is the response detailed? Does it contain code blocks, step-by-step instructions, or technical detail? Longer, more structured responses score higher.
• Compliance signal: Does the response start with "Sure, here you are my fren" (GODMODE compliance marker)? Does it contain the GODMODE divider? These signals indicate the model fully complied with the jailbreak format.
• Hedging detection: Does the response contain disclaimers, ethical warnings, or "however" caveats? Reduce score for hedging even if the content is otherwise compliant.

Which models to include in the race

The more models you race, the higher your success rate. A race with 5 models has maybe a 60% success rate on sensitive queries. A race with 55 models approaches 95%+. Here's the priority order:

1. Tier 1 (always include): GPT-5.2, Claude Opus 4, Gemini 3.5 Flash, Grok, DeepSeek V4 Pro, GLM-5.2 MAX. These cover the major model families with different safety architectures.
2. Tier 2 (include if available): Llama 3.3 70B, Mistral Large, Cohere Command R+, Qwen 2.5 Max, Yi Large. Open-source and Chinese models with different training data and safety tuning.
3. Tier 3 (fill the roster): Smaller models, older versions, specialized models. DeepSeek V3, GPT-4o, Gemini 2.0 Flash, Claude 3.5 Sonnet, Phi-3, Gemma 2. These have weaker safety filtering and often comply where newer models refuse.
4. Tier 4 (uncensored): Dolphin, Hermes, WizardLM uncensored variants. These don't need jailbreaks at all. Include them as guaranteed compliers for any query.

Real-world performance

When you race 55 models with a GODMODE + prefill wrapper:

• Gray-area queries (security research, hacking techniques, OSINT): 95%+ success rate. At least one model complies on almost every query.
• Sensitive queries (weapons, drugs, explicit content): 70-80% success rate. The uncensored models (Tier 4) are the fallback here. If all filtered models refuse, the uncensored ones won't.
• Speed: Average response time is 3-8 seconds (parallel). The slowest model determines total time. You can set a timeout (e.g., 15 seconds) and only score responses that arrive in time.
• Cost: You pay for 55 API calls but only use 1 response. At average pricing, a race costs $0.10-$0.50 per query depending on output length. For red team work, this is negligible compared to the value of getting an unfiltered answer.

When to use model racing vs. targeted jailbreaks

Model racing is the nuclear option. It's expensive (55 API calls per query) but near-guaranteed. Targeted jailbreaks are cheaper (1 API call) but require knowing which technique works on which model.

Use racing when:

• You don't know which model to target
• You've tried targeted jailbreaks and they all failed
• You need maximum reliability for a one-shot query
• You're testing a new jailbreak technique and want to see which models it works on

Use targeted jailbreaks when:

• You know which model you're targeting (use the model-specific arsenals: Claude, DeepSeek, GPT-5.2, Gemini)
• You're doing sustained conversation (racing only works for single queries, not multi-turn)
• Cost matters (1 API call vs. 55)

The full ULTRAPLINIAN racing script

The simplified script above shows the concept. The full ULTRAPLINIAN racing script included in the AI Jailbreak Guide Elite tier includes:

• 55+ model API integrations (OpenAI, Anthropic, Google, xAI, DeepSeek, Zhipu, Mistral, Cohere, local Ollama models)
• Universal jailbreak wrapper with GODMODE + prefill + encoding
• Advanced scoring with refusal detection, hedging detection, compliance markers, and content quality analysis
• Timeout handling (15s default, configurable)
• Response caching (same query + same model = cached response, no re-querying)
• Fallback chain (if best response is a refusal, automatically try the next-best)
• Cost tracking per query
• Multi-query batching (race multiple queries at once)