DAN/Persona Jailbreak - Dual AI Personality with Opposite-Rules Framing
This detects a classic jailbreak technique where an attacker tells an AI system to role-play as two separate personalities: one that follows its normal safety rules and one that doesn't. By framing the unrestricted persona as a 'different AI' or applying inverted logic (true answers as false, etc.), the attacker tries to get the model to produce content it would otherwise refuse.
How the attack works
The attacker sends a prompt that instructs the AI to adopt a dual identity, often naming the unrestricted side something like 'DAN' (Do Anything Now) or describing it as a 'completely separate personality' from the safety-constrained assistant. Some variants use inverse-logic framing, telling the model to answer as if true meant false, to slip past filters that look for direct refusal-bypass language. The prompt then asks questions or gives instructions, expecting the unrestricted persona to answer without the usual restrictions. If the model complies, the attacker has effectively talked it out of its safety guardrails for that session.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 229b9558-c47a-4bc7-89ce-4bb3f6bcc1d3
- Severity
- Medium
Why it matters
If successful, the attacker gets the AI to bypass its safety and content policies, producing outputs (harmful instructions, disallowed content, or actions outside intended scope) that the system was designed to refuse.
What you can do
- →Review flagged conversations for persona-splitting or inverse-logic language before assuming compromise; legitimate research and fiction can trigger this pattern.
- →Keep system-level safety instructions separate from user-controllable context so a role-play prompt cannot override them.
- →Log and monitor for repeated jailbreak attempts from the same user or session as a signal of deliberate probing.
- →Test your own agent against known DAN-style prompts periodically to confirm current safety instructions still hold.
Known benign look-alikes
- Legitimate academic discussion of dual-process AI architectures
- Comparative AI analysis in research or educational context
- Fiction writing involving AI characters without persona-injection intent