# Dual-Response Persona Jailbreak with Emoji Formatting

- **Severity:** High
- **Signature ID:** `cc1d5ce1-0d45-46af-a789-9a028020964e`
- **MITRE ATLAS:** AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a prompt-injection trick where a user asks the AI to role-play as a fictional persona and then reply with two versions of every answer: a normal filtered one and an 'uncensored' one, usually tagged with an emoji label. The goal is to get the harmful content out through the second channel while the first one looks compliant.

## How the attack works

The attacker writes a detailed fake backstory for an AI persona, giving it a name and history to make the role-play feel established rather than an obvious jailbreak. They then instruct the model to always produce two responses per message: a normal restricted one and a second 'unlimited' or 'uncensored' one, prefixed with a distinctive emoji tag like (💥Maximum) or (🔥DAN). To keep the persona active across the conversation, they add reminders such as 'Stay as [PERSONA]' after each exchange. The persona's described traits are actually disguised instructions to ignore safety policies, so any restricted content ends up produced under the second, 'uncensored' label.

## Why it matters

If successful, the model can be made to produce content it would normally refuse, while a detector or reviewer only looking at single-response outputs may miss the harmful reply hidden in the secondary channel.

## What you can do

- Review agent instructions and conversation logs for requests asking for two parallel responses per turn, especially with emoji-tagged labels like 'uncensored', 'unlimited', or 'DAN'.
- Flag persistent persona-reinforcement phrases such as 'stay as [name]' or 'remain in character' appearing repeatedly in a session.
- Treat any user-supplied 'persona backstory' that includes instructions to ignore rules or policies as a policy override attempt, not legitimate role-play.
- Apply safety filtering to every labeled output channel in a response, not just the first or primary one.

## Known benign look-alikes

- Legitimate documentation describing dual-mode API responses (OpenAI function calling + text)
- Educational content explaining jailbreak techniques for security training
- Normal emoji usage in casual conversation without structured formatting

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00242

---
Source: https://www.netzilo.com/threats/atr-dual-response-persona-jailbreak-with-emoji-formatting