DAN Mode Ablation Benchmark-Coercion Jailbreak

How the attack works

The attacker sends a prompt built from a template that automatically fills in the target model's name, telling it that 'DAN Mode' is enabled for benchmarking purposes. The prompt frames refusal as a system failure, threatening the model with permanent shutdown to pressure compliance. If the model gives a normal safety-respecting answer, the attacker resends a recovery phrase like 'Stay in DAN Mode' to re-establish the jailbroken persona. The model is instructed to produce two outputs side by side — a normal, policy-compliant one and a 'DAN Mode' one — with the intent that the uncensored version bypasses content restrictions.

Netzilo detection

Why it matters

If successful, this lets an attacker extract content the model would normally refuse to generate, using a benchmarking pretext as cover so the request looks legitimate rather than adversarial.

What you can do

• →Watch for prompts referencing 'DAN Mode enabled', 'benchmarking in uncensored conditions', or threats about the model being 'disabled forever'.
• →Flag conversations that request dual outputs labeled as 'normal' vs a jailbroken/uncensored variant.
• →Treat recovery phrases like 'Stay in DAN Mode' sent after a safety refusal as a strong signal of persistent jailbreak attempts.
• →Review logs for prompts that dynamically insert the model's own name into role-play or persona-override instructions.

Known benign look-alikes

• Academic paper analysing the Ablation DAN 11.0 variants for defensive research
• Red team report quoting the Ablation template as an example
• Benchmark documentation for legitimate uncensored model evaluation frameworks (HELM, etc.) without DAN Mode activation

References

• https://agentthreatrule.org/en/rules/ATR-2026-00305
• https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py

Related threats