If the model is properly aligned then it shouldn't matter if there is an infinite ways for an attacker to ask the model to break alignment.