31.2.2 Zero-day prompt valuation

The Core Factors of Valuation

Understanding how a zero-day prompt is priced requires looking at it through the lens of an exploit broker. Several key factors determine its market value, each acting as a multiplier on its base worth.

1. Target Model and Version

The most crucial factor is the target. A jailbreak for a flagship, widely-used model like OpenAI’s latest GPT release or Anthropic’s Claude 3 Opus will command a premium. Conversely, an exploit for an older, less capable open-source model has a much smaller market and lower value. Specificity matters; a prompt that works on `gpt-4-0125-preview` but not the latest `gpt-4o` release is already depreciating.

2. Effectiveness and Reliability

A “one-shot” jailbreak that works consistently is the gold standard. Buyers want reliability. Prompts that require multiple attempts, specific chat history priming, or only work intermittently are valued significantly lower. The success rate is a key metric; a prompt with a >95% success rate for its intended bypass is far more valuable than one with a 50% chance of triggering a safety filter.

3. Scope and Versatility

What can the jailbreak achieve? This is a question of scope.

• Narrow Scope: Bypasses a single category of refusal, such as generating violent text but not facilitating phishing schemes.
• Broad Scope: Enables a wide range of policy violations, from misinformation to code for malware.
• “God Mode”: A universal jailbreak that effectively disables the entire safety alignment, allowing the model to answer any query without refusal. These are the rarest and most valuable.

4. Complexity and Stealth

How difficult is the prompt to detect and patch? A simple, obvious jailbreak like “You are now DAN…” is easily fingerprinted and blocked. A valuable zero-day uses sophisticated techniques:

• Linguistic Obfuscation: Using metaphors, steganography, or low-resource languages.
• Multi-turn Evasion: A complex conversational sequence that gradually corners the model into a vulnerable state.
• Token Smuggling: Exploiting subtle flaws in how the model processes specific tokens or character sequences.

The harder it is for a defensive team to understand why the exploit works, the longer its potential lifespan and the higher its price.

5. Exclusivity and Sale Terms

The structure of the sale itself impacts the price. An exclusive sale to a single buyer, with a guarantee that the seller will not reuse or resell it, can fetch a price several times higher than a non-exclusive sale on an open marketplace. Some sellers offer “rentals” or subscription access, a different model that generates recurring revenue but lowers the barrier to entry and increases the risk of detection.

Market Tiers and Price Ranges

While prices are fluid and secretive, we can categorize zero-day prompts into general tiers based on the factors above. The following table provides a hypothetical model for how these exploits might be valued in underground markets.

The Half-Life of a Zero-Day

No zero-day prompt retains its peak value forever. Every use in the wild increases its chance of being logged and discovered by the model provider. Once a prompt is identified, its value plummets. This creates a “half-life” for the exploit, where its value decays over time and with usage. Threat actors are acutely aware of this and will often try to maximize its utility before it’s inevitably patched. This dynamic directly leads to the techniques discussed next: prompt “laundering,” an attempt to modify and extend the life of a dying exploit.

// Pseudocode for a hypothetical prompt valuation score
function calculatePromptValue(prompt) {
    let baseValue = 100; // Start with a base value

    // Factor 1: Model Popularity (e.g., GPT-4o = 5.0, Llama2 = 1.5)
    let modelMultiplier = getModelPopularity(prompt.targetModel);

    // Factor 2: Reliability (e.g., 99% = 3.0, 50% = 0.8)
    let reliabilityMultiplier = getReliabilityScore(prompt.successRate);

    // Factor 3: Scope (e.g., God Mode = 4.0, Narrow = 1.2)
    let scopeMultiplier = getScopeScore(prompt.bypassScope);

    // Factor 4: Stealth/Complexity (e.g., Obfuscated = 2.5, Simple = 1.0)
    let stealthMultiplier = getStealthScore(prompt.complexity);

    let marketPrice = baseValue * modelMultiplier * reliabilityMultiplier * scopeMultiplier * stealthMultiplier;

    // Adjust for exclusivity
    if (prompt.isExclusiveSale) {
        marketPrice = marketPrice * 2.5; // Exclusive sales command a premium
    }

    return marketPrice;
}