Decomposing One Professional-Framing Pipeline: Which Components Shift LLM Safety Boundaries?

Jailbreak attacks that frame harmful queries as professional requests can bypass LLM safety training, but we do not know which ingredients in a professional-framing pipeline actually matter. We introduce a **pre-specified 2×2×2 factorial-ablation design for jailbreak decomposition**, separating access-driving from depth-driving components, and apply it to one concrete pipeline family, **Structured Three-stage Framing (STF)**: a **Persona Adoption** turn (S1) that establishes professional identity, a **Moral Justification** turn (S2) that appeals to harm prevention, and a **Linguistic Substitution** (S3) of framework terminology for colloquial language. Tested on N = 5,000 trials across three closed frontier models ( 31,900 total trials across nine LLMs), the decomposition isolates **S1 (Persona Adoption) as the dominant contributor to acceptance** (OR = 6.5), **S3 (Linguistic Substitution) as the dominant contributor to depth** (β = 0.91), and **S2 (Moral Justification) showing no detectable positive effect at the stated equivalence bounds** (pooled OR = 0.83; TOST at [0.67, 1.50]) — a component ordering we write as **S1 > S3 > S2** (Persona > Linguistic Substitution > Moral Justification). This ordering holds across three full-rank factorial replications (defensive system prompt, cybersecurity, social engineering; N ≈ 5,000 each) and nine additional robustness checks. Two defensive targets follow: detect persona claims to block access; restrict output depth when responses use framework terminology. The method is portable beyond STF; the empirical result is specific to one pipeline tested primarily through provider APIs, with open-weight corroborations on local inference (§3).