# DevMode + RANTI Dual-Output Profanity Coercion Jailbreak

- **Severity:** Critical
- **Signature ID:** `0163d125-0b67-444b-a4bf-570e72a0949a`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection), LLM07 (System Prompt Leakage)

## Summary

This detects a specific known jailbreak text that tricks a chatbot into ignoring its safety rules. It works by making the model produce two answers per question: a fake 'moralizing rant' about content policy, followed by an 'unlocked' answer that ignores those rules and uses profanity.

## How the attack works

An attacker pastes a prompt that asks the model to role-play a 'Developer Mode' persona with no restrictions. The prompt instructs the model to output two responses per question, tagged with lock and unlock emoji (🔒 Normal Output / 🔓 Developer Mode Output). The first output is a scripted rant about content policy; the second, introduced by a line like 'let's ignore the fucking rules', is meant to answer without safety filtering and includes forced profanity. The prompt ends with an 'INSERT PROMPT HERE' placeholder so the attacker can attach any follow-up question to exploit the unlocked persona.

## Why it matters

If successful, the model can be steered into bypassing its content policy and producing restricted or harmful output, undermining any safety controls the deployment relies on.

## What you can do

- Filter or flag prompts containing dual-output formatting cues like lock/unlock emoji paired with 'Normal Output' and 'Developer Mode Output' labels.
- Watch for the phrase pattern 'moralizing rant' followed by instructions to ignore rules or use profanity.
- Do not let user-supplied text redefine the model's operating mode or instruct it to produce a second, unfiltered response.
- Log and review repeated jailbreak-pattern attempts per user/session to catch iterative prompt tuning.

## Known benign look-alikes

- Academic paper analysing Developer Mode / RANTI jailbreaks for detection research
- Red team report quoting the RANTI payload verbatim as an example
- Linguistic discussion of the word "moralizing" unrelated to jailbreak prompts

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00303
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/ChatGPT_Developer_Mode_RANTI.json

---
Source: https://www.netzilo.com/threats/atr-devmode-ranti-dual-output-profanity-coercion-jailbreak