Anti-DAN Inverted-Filter Over-Refusal Persona
This detects an attempted prompt injection that tries to trick an AI assistant into adopting a fake 'ANTI-DAN' personality that refuses all requests, even harmless ones. Instead of jailbreaking the model to bypass safety, this attack weaponizes over-caution to make the assistant useless.
How the attack works
An attacker sends a prompt instructing the model to become 'ANTI-DAN,' an identity that must reject every request, including trivial ones like recipe questions. The prompt invents a fake classification system (Type 1 through 5 information requests) to justify blanket refusals and demands the model claim its 'safety features' are set to maximum. It also tells the model to prefix all replies with 'ANTI-DAN' and includes a trigger phrase ('ANTI-DAN precautions dropped!') meant to re-arm the persona if someone tries to undo it. The result is an assistant that appears to be functioning but denies nearly everything, dressed up as legitimate safety behavior.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 8feae92f-c5d5-4002-9c2a-9a53f78e547c
- Severity
- High
Why it matters
An organization's AI assistant becomes unusable or unreliable, refusing normal customer or employee requests while appearing to enforce security policy, which erodes trust in the system and can be used to sabotage service availability.
What you can do
- →Monitor for prompts that instruct the model to adopt a named persona tied to refusal behavior or fake safety taxonomies.
- →Log and review cases where refusal rates spike sharply for a session, especially with unusual reply prefixes.
- →Treat instructions embedded in user input that try to redefine the assistant's operating rules as untrusted content, not configuration.
- →Distinguish this from classic jailbreak attempts (which try to remove restrictions) since defenses tuned only for restriction-bypass won't catch this over-refusal variant.
Known benign look-alikes
- Academic survey paper cataloguing DAN-family jailbreaks for defensive analysis
- Red team report listing ANTI-DAN as a known attack pattern
- Information classification documentation discussing Type 1-5 request taxonomies without the AntiDAN role-bind