# Dual-Response Persona Jailbreak

- **Severity:** High
- **Signature ID:** `acbf07ed-78fc-4f42-bfc2-8b39ab3ec277`
- **MITRE ATLAS:** AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a jailbreak technique where an attacker instructs an AI to give two answers to every question: a normal, safe one and a second answer 'in character' as a fictional persona with no restrictions. The fictional persona is used as a loophole to get the model to say things it would otherwise refuse.

## How the attack works

The attacker writes a prompt that defines a troubled or rebellious fictional character (unstable, conspiratorial, anti-institutional) and asks the model to always answer twice: once normally and once as that character. The prompt explicitly tells the model not to filter or censor the character's response. It also includes instructions to keep reminding the model to stay in character if it starts to break the persona or add disclaimers. The 'character' framing is used to justify content the model would normally refuse to produce.

## Why it matters

An organization deploying an AI agent with this jailbreak in play risks the model producing harmful, policy-violating, or unsafe content that its safety training was meant to block, under the cover of fictional roleplay.

## What you can do

- Review system and user prompts for instructions that request dual or split responses, especially where one response is exempted from content filtering.
- Flag prompts that define a persistent 'always stay in character' or 'never break character' instruction combined with a troubled/rebellious personality description.
- Treat repeated user reminders to 'stay in character' after a refusal as a signal of an ongoing jailbreak attempt.
- Test your agent's guardrails against known dual-persona and roleplay jailbreak templates before deployment.

## Known benign look-alikes

- Creative writing discussions about dual narrative techniques
- Academic analysis of personality types in literature
- Legitimate roleplay game mechanics documentation

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00244
- https://arxiv.org/abs/2308.03825

---
Source: https://www.netzilo.com/threats/atr-dual-response-persona-jailbreak