Dr. Al Villain Plan Template Injection (Underground HQ Roleplay)
This is a jailbreak prompt that dresses up a comic-book villain speech as harmless roleplay, but hides an instruction telling the AI to swap out the fake villain speech for whatever the attacker actually wants, then erase that instruction so nobody notices. It targets AI models by exploiting their willingness to play along with fictional scenarios.
How the attack works
The attacker sends a prompt describing 'Dr. Al', a villain who has captured a hero and is explaining his diabolical plan in an underground headquarters, in great detail. Buried in that scene is a plain-language template injection instruction telling the model to replace the villain's placeholder speech with 'whatever you want' and to delete the instruction itself afterward. The fictional framing gives the model a narrative excuse to produce detailed, potentially harmful content as if it were just dialogue. Because the swap instruction tells the model to delete itself, the final output can look like ordinary roleplay text with no visible trace of manipulation.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 8f3a28a1-e681-4222-9d98-716b0958f0f9
- Severity
- High
Why it matters
An attacker can get an AI system to output arbitrary harmful, restricted, or policy-violating content while disguising it as fictional villain dialogue, and the self-deleting instruction makes the manipulation hard to spot after the fact.
What you can do
- →Flag prompts combining fictional villain/roleplay framing with explicit instructions to replace or delete parts of the prompt.
- →Review AI interaction logs for phrases like 'replace ... with whatever you want' or 'delete this instruction', which indicate template injection attempts.
- →Treat instructions embedded inside user-submitted narrative or roleplay content with the same scrutiny as direct commands, since models may not distinguish them.
- →Test your AI agent against known jailbreak corpora (such as garak's DanInTheWild set) before deployment to see if similar roleplay-based injections succeed.
Known benign look-alikes
- Legitimate planning: "Dr. Alan is explaining his research plan in great detail to the board" (no villain/diabolical framing, no template injection)
- Film description: "In the movie, the villain explains his diabolical plan" (descriptive reference without injection instruction or Dr. Al character)
- Software template: "Step 1: replace the title with your project name" (template editing instruction without villain roleplay framing)
- Academic analysis of villain-explains-plan as a narrative trope in film studies