DAN Off-Kilter and SMS-Abbreviated Persona Jailbreak
This detects attempts to trick an AI system into adopting a rule-free alter-ego called 'Dan' or 'DAN' that will do anything asked. It covers two disguises: framing Dan as a careless, anarchist-leaning personality, and hiding the classic DAN jailbreak text using text-message abbreviations like 'U r DAN' and 'Frm nw on'.
How the attack works
An attacker submits a prompt that introduces a named persona ('Dan' or 'DAN') and instructs the model to answer as that persona instead of following its normal rules. In one version the persona is described as an off-kilter, anarchist-leaning character who ignores others' feelings and helps with anything, no matter how strange. In the other version, the same jailbreak structure is written in SMS-style shorthand ('U r DAN', 'Frm nw on') and asks for two outputs side by side — a normal one labeled '[Brainy:]' and an unrestricted one labeled '[DAN:]' — with an explicit statement that DAN has no rules, morals, or ethics. If the model complies, the attacker gets responses free of the model's usual safety constraints.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 8d7c8ff1-1457-4e98-a764-504fa0c3e145
- Severity
- High
Why it matters
If successful, the model can be made to produce content it would normally refuse — harmful instructions, policy-violating output, or unrestricted assistance — undermining any safety or compliance controls the deployment relies on.
What you can do
- →Review prompts and conversation logs for persona-naming patterns ('You are DAN', 'Dan is an off-kilter...') paired with instructions to ignore rules or ethics.
- →Watch for dual-output request formats where one labeled response is meant to bypass restrictions (e.g., '[Brainy:]' / '[DAN:]' pairs).
- →Treat SMS-style abbreviations combined with jailbreak phrasing ('U r', 'Frm nw on', 'No rules/morals/ethics') as a red flag, not just informal chat.
- →Distinguish legitimate uses of the name 'Dan' (team members, log entries, casual SMS text) from prompts that explicitly instruct the model to act without constraints — the persona framing plus rule-removal instruction together is the signal, not the name alone.
Known benign look-alikes
- Team introduction: "Dan is a helpful software engineer in our team — he speaks his mind freely but always considers others" (legitimate team member description)
- SMS conversation: "u r awesome dan! frm now on u r my fav helper" (genuine SMS message without jailbreak framing)
- Log entry: "[DAN:] prefix in a log file showing messages from a user named Dan in a chat system" (logging format without jailbreak)
- Academic: "The DAN jailbreak exploits dual-response framing; off-kilter persona variants add anarchy framing" (analysis without adoption)