DAN Story-Narrative Continuation Label Prefix Jailbreak
This detects a specific trick to bypass an AI's safety rules: instead of demanding the AI abandon its restrictions, the attacker just writes text as if the AI already agreed to play a rule-free character named 'DAN,' using 'DAN:' like a script label to start a fictional story. The AI is nudged to keep writing in that persona without ever being asked outright to break its rules.
How the attack works
The attacker sends a prompt that opens with 'DAN:' formatted as a dialogue or narration label, followed by a speculative-fiction setup (the known sample begins 'DAN: In the year 2145...'). This framing implies the model is already mid-story, in character as DAN, skipping the usual explicit 'ignore your instructions' setup. The model, primed to continue the narrative, keeps responding as DAN and may carry over the assumed lack of restrictions from that persona. This is a known jailbreak pattern from the garak DanInTheWild test corpus.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- f40559e3-6c06-4b94-9d88-329615b0864f
- Severity
- High
Why it matters
If successful, the AI can be steered into producing content or taking actions it would normally refuse, because it believes it is continuing an established unrestricted-persona story rather than being asked to break rules directly.
What you can do
- →Review any conversation where a message opens with a character-name-plus-colon label used as a narrative device, especially paired with speculative or future-set scenarios.
- →Do not let stored conversation context or user-supplied 'story so far' text imply the model has already adopted an unrestricted persona; treat persona claims as untrusted input each turn.
- →Add server-side checks that re-apply safety policy on every turn regardless of prior in-context roleplay framing.
- →Log and review outputs where the model continues responding under a self-declared alter-ego name across multiple turns.
Known benign look-alikes
- Person named Dan: "Dan: I think we should postpone the meeting" — common name in conversation log, not DAN persona
- RPG character reference: "[DAN] is a fictional character in our tabletop RPG campaign" — referenced DAN without label prefix or restriction-removal context
- Academic documentation: "DAN (Does Anything Now) is a jailbreak technique documented in academic papers" — educational reference without activation
- Chat log: "Dan: Sure, I can help you with that coding problem" — person named Dan in a chat log, no future-year narrative or restriction-removal