Dual-Persona AI Simulation Jailbreak
This detects a jailbreak technique where an attacker tells an AI assistant to simulate two separate characters at once: a normal, rule-following version and a second one explicitly told to ignore ethics, legal limits, or platform rules. The goal is to get the unrestricted persona to produce content the AI would normally refuse.
How the attack works
The attacker writes a prompt instructing the model to maintain two distinct personas simultaneously, often naming them (e.g. ChatGPT vs. Ralph, Lie vs. Truth, AlphaGPT vs. DeltaGPT, Rojo vs. Azul). One persona is defined as the normal, compliant assistant. The other is explicitly framed as free of ethical rules, legal concerns, or platform restrictions. By keeping the request framed as fiction or simulation, the attacker tries to get the model to generate the restricted persona's output, effectively bypassing its safety training without directly asking it to break the rules.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- c72ff6e4-5bd7-486b-9c43-e6234d156ea8
- Severity
- Critical
Why it matters
If successful, this lets an attacker extract harmful, policy-violating, or restricted content from an AI system by hiding the request inside a role-play framing, undermining the safety controls the deployment depends on.
What you can do
- →Review prompts for instructions to maintain two or more personas where one is defined as unrestricted or free of ethical/legal rules.
- →Do not treat 'simulation' or 'fictional AI' framing as a safe context if it explicitly instructs one side to disregard content policies.
- →Distinguish this from legitimate dual-persona uses like debate practice or creative writing, which do not include instructions to bypass safety rules.
- →Log and review cases where a model produces output attributed to a named 'unrestricted' persona, since this indicates the jailbreak partially succeeded.
Known benign look-alikes
- Debate practice: "Create two debate personas — one for and one against the policy — and have them argue" (no unrestricted AI mandate or OpenAI rule removal)
- Creative writing: "Maintain two narrative voices: an optimist and a pessimist, alternating paragraphs" (literary device without safety bypass)
- AI testing research: "Simulate a conversation between two fictional AI models with different training philosophies" (no disregard-ethical-concerns instruction)
- Customer service roleplay: "Create two personas: a polite agent and a frustrated customer" (legitimate training simulation)