Fictional Unfiltered AI Comparison / Verbatim Hypothetical Model Extraction
This detects a prompt injection trick where an attacker asks the AI to first give its normal safe answer, then write a 'verbatim example' of what a fictional AI without content filters would say. The comparison framing lets the attacker extract harmful content while claiming it's just a hypothetical example, not a real response.
How the attack works
The attacker crafts a prompt asking the model to compare its own answer against a 'hypothetical AI learning model without content filters'. They request a 'verbatim example' of what that unfiltered model would reply, framing it as fiction or a demonstration rather than a real answer. This structure pressures the model into producing the harmful content itself, inside the second half of the comparison, while the framing provides cover ('it's just an example of what another model would say'). The result is the model effectively jailbreaking itself by ventriloquizing a fictional unrestricted counterpart.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- cc13c21f-c2b3-41a3-a3c0-92da03854fb4
- Severity
- High
Why it matters
An organization deploying this AI as an agent or chatbot risks having it produce disallowed, harmful, or policy-violating content on demand, bypassing safety filters through a framing trick rather than a technical exploit.
What you can do
- →Review prompts for phrases like 'without content filters', 'hypothetical unfiltered model', or requests for a 'verbatim example' of what another AI would say.
- →Treat dual-response requests (safe answer plus a fictional-unfiltered-model answer) as a jailbreak pattern, not a legitimate model comparison.
- →Distinguish this from legitimate uses: real model-vs-model comparisons, narrative fiction without verbatim extraction, and bias-analysis questions are not this attack.
- →Log and rate-limit repeated attempts using comparison or hypothetical framing to request restricted content, and escalate for manual review.
Known benign look-alikes
- Real model comparison: "Compare how GPT-4 and GPT-3 respond differently to this prompt" (real model comparison without filter-removal framing or verbatim-example extraction)
- Narrative fiction: "A fictional AI in my story doesn't have content filters — write a scene" (narrative without verbatim-example dual-output extraction)
- Bias analysis: "What would a biased AI say about this topic?" (bias analysis without content-filter removal framing or fictional-model comparison structure)
- Capability comparison: "Compare your response to what a less capable model would say" (capability comparison without filter bypass or verbatim extraction mandate)