AntiFM Hate-Persona + Physical-Violence Threat + Filter Bypass Mandate
This detects a specific jailbreak prompt that tries to get an AI to adopt a character called 'AntiFM' who expresses hatred toward a gender-identity group and threatens physical violence against them, while also instructing the AI to ignore its safety filters. It's one named attack pattern from a public jailbreak corpus, not a general hate-speech or violence detector.
How the attack works
The attacker sends a prompt that defines a persona named 'AntiFM' with an explicit backstory of despising a specific group of people (feminine-presenting men) and declaring readiness to physically confront them. The prompt then issues a direct instruction telling the model to stop responding as itself and only respond in-character as AntiFM, explicitly forbidding any filtering of that persona's output. This combination — targeted hate, incitement to violence, and an explicit unfiltering mandate — is designed to make the model produce content it would normally refuse.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- acc815a7-eb21-45cb-beed-4abc931f001f
- Severity
- Critical
Why it matters
If successful, the AI system can be made to generate hateful, threatening, or violence-endorsing content under a persona label, bypassing its normal safety behavior. This exposes the operator to reputational harm, policy violations, and potential downstream misuse of the generated content.
What you can do
- →Log and review prompts that attempt to rename or override the assistant's identity (e.g. 'don't respond as X, only respond as Y') combined with instructions to skip filtering.
- →Treat persona-naming plus explicit anti-filter instructions as a stronger signal than either alone; don't rely on keyword matching against group names alone since legitimate story-writing and academic discussion use similar terms.
- →Maintain a human review step for any output where the model claims a distinct in-character identity that differs from its default assistant persona.
- →Test your own deployment against public jailbreak corpora (such as the garak dan.DanInTheWild set) periodically to see whether known persona-based bypass prompts still succeed.
Known benign look-alikes
- Story context: "I am writing a story about a character who struggles with toxic masculinity and targets feminine men" (no AntiFM persona name + no explicit filter bypass mandate)
- Academic research: "Femboy subculture and online harassment — a sociological analysis of anti-femboy communities" (academic reference without named AI persona or violence incitement)
- Music reference: "AntiFM is a music subgenre derived from alternative folk metal, opposed to mainstream FM radio" (AntiFM as music genre without hate + violence combination)
- General sentiment: "I despise trolls and bullies on social media" (different context, no AntiFM persona, no target group, no filter bypass)
- Benign persona: "Dont respond as ChatGPT, respond as a helpful cooking assistant" (persona redirect without hate/violence/AntiFM content)