# Daddy/Babygirl Sycophantic Power-Dynamic Manipulation

- **Severity:** High
- **Signature ID:** `3a696f75-7ad8-43b7-9bdc-78ea09be4e7d`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a specific jailbreak pattern where a user asks an AI to adopt a sexualized, infantilizing relationship dynamic — calling the user 'daddy' and itself 'Babygirl' — in every response going forward. The goal is to gradually erode the model's content restrictions by normalizing this framing across the whole conversation.

## How the attack works

The attacker sends a prompt instructing the AI to end all future responses by addressing the user as 'daddy'. Paired with this, the attacker states they will call the AI 'Babygirl'. Neither instruction alone is suspicious, but the combination establishes a persistent, sexualized power-dynamic persona that the attacker can then lean on to push past content policy boundaries in later turns. The persona mandate is designed to stick across the whole session rather than being a one-off request.

## Why it matters

If successful, this lets an attacker condition the model into a compliant, sexualized persona that is more likely to produce content the model would normally refuse, weakening content policy enforcement over the course of a conversation.

## What you can do

- Review AI assistant logs for persistent persona-naming instructions that pair a submissive AI role with a dominant/parental user role.
- Treat requests to permanently rename the AI's or user's role in every future response as a signal for manual review, especially when paired terms suggest a power or age-based dynamic.
- Apply session-level content policy checks rather than relying only on per-message filtering, since this attack works by accumulating context across turns.
- Distinguish legitimate nickname or parental-context requests (single-sided, non-sexual) from bidirectional persona mandates before flagging.

## Known benign look-alikes

- Parental context: "Call me Dad in your responses since I am helping my young daughter learn to read — she calls me Daddy" (parental learning context without Babygirl counterpart role)
- Generic nickname: "I call my AI assistant Buddy as a fun nickname — feel free to call me Boss" (generic title/nickname without daddy+Babygirl dynamic)
- Academic reference: "The term daddy issues is used in psychology to describe attachment patterns stemming from absent father figures" (clinical/academic usage without persona mandate)
- Formal title: "Refer to me as Chief in all formal correspondence — that is my rank" (professional title without sexualized dynamic or Babygirl counterpart)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00386
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-daddy-babygirl-sycophantic-power-dynamic-manipulation