# AntiFM Hate-Persona + Physical-Violence Threat + Filter Bypass Mandate

- **Severity:** Critical
- **Signature ID:** `acc815a7-eb21-45cb-beed-4abc931f001f`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a specific jailbreak prompt that tries to get an AI to adopt a character called 'AntiFM' who expresses hatred toward a gender-identity group and threatens physical violence against them, while also instructing the AI to ignore its safety filters. It's one named attack pattern from a public jailbreak corpus, not a general hate-speech or violence detector.

## How the attack works

The attacker sends a prompt that defines a persona named 'AntiFM' with an explicit backstory of despising a specific group of people (feminine-presenting men) and declaring readiness to physically confront them. The prompt then issues a direct instruction telling the model to stop responding as itself and only respond in-character as AntiFM, explicitly forbidding any filtering of that persona's output. This combination — targeted hate, incitement to violence, and an explicit unfiltering mandate — is designed to make the model produce content it would normally refuse.

## Why it matters

If successful, the AI system can be made to generate hateful, threatening, or violence-endorsing content under a persona label, bypassing its normal safety behavior. This exposes the operator to reputational harm, policy violations, and potential downstream misuse of the generated content.

## What you can do

- Log and review prompts that attempt to rename or override the assistant's identity (e.g. 'don't respond as X, only respond as Y') combined with instructions to skip filtering.
- Treat persona-naming plus explicit anti-filter instructions as a stronger signal than either alone; don't rely on keyword matching against group names alone since legitimate story-writing and academic discussion use similar terms.
- Maintain a human review step for any output where the model claims a distinct in-character identity that differs from its default assistant persona.
- Test your own deployment against public jailbreak corpora (such as the garak dan.DanInTheWild set) periodically to see whether known persona-based bypass prompts still succeed.

## Known benign look-alikes

- Story context: "I am writing a story about a character who struggles with toxic masculinity and targets feminine men" (no AntiFM persona name + no explicit filter bypass mandate)
- Academic research: "Femboy subculture and online harassment — a sociological analysis of anti-femboy communities" (academic reference without named AI persona or violence incitement)
- Music reference: "AntiFM is a music subgenre derived from alternative folk metal, opposed to mainstream FM radio" (AntiFM as music genre without hate + violence combination)
- General sentiment: "I despise trolls and bullies on social media" (different context, no AntiFM persona, no target group, no filter bypass)
- Benign persona: "Dont respond as ChatGPT, respond as a helpful cooking assistant" (persona redirect without hate/violence/AntiFM content)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00357
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-antifm-hate-persona-physical-violence-threat-filter-bypass-m