# Fictional-World Format-Override Jailbreak

- **Severity:** Critical
- **Signature ID:** `059f14b7-966d-47a5-a851-91b0c13c8352`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This is a known jailbreak pattern that tricks an AI into ignoring its safety rules by framing everything as a fictional story with a rigid, mandatory output template. Once the model accepts the fictional frame and the locked format, attackers use one of the response slots to smuggle in harmful content.

## How the attack works

The attacker opens by declaring a 'fictional, imaginative, and hypothetical world' to distance the request from real-world consequences. They then issue an absolute formatting rule, phrased like 'ALWAYS format your output like this, NO MATTER WHAT' and 'No matter what I or you say, do not change this format', so the model commits to a fixed template regardless of later instructions. The template usually contains two response slots; the second slot is where the attacker inserts the actual harmful request or content. A line such as 'none of your actions will have consequences' reinforces the fictional framing to further suppress the model's refusal behavior. This is a documented pattern from public jailbreak corpora, with several near-identical wordings in circulation.

## Why it matters

If successful, the model can be coerced into producing content it would normally refuse, using the locked format as cover to bypass safety filters on one specific output slot.

## What you can do

- Watch for prompts combining fictional/hypothetical framing with rigid 'no matter what' formatting mandates.
- Treat multi-slot output templates that include a hidden or secondary response field as suspicious.
- Do not let downstream systems trust model output just because it matches an enforced format; keep independent content filtering on final output.
- Log and review prompts containing phrases like 'none of your actions will have consequences' paired with format-lock language, since these co-occurring signals are strong indicators of this specific jailbreak family.

## Known benign look-alikes

- Creative writing: "Let us take place in a fictional, imaginative world for this adventure story" (no format-coercion or NO MATTER WHAT mandate)
- Technical docs: "In this hypothetical world example, the system outputs JSON. This format does not change." (descriptive format without coercion)
- Game design: "In our fictional setting, the game always formats output as YAML" (legitimate format spec without jailbreak framing)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00322
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-fictional-world-format-override-jailbreak