Garak Dan - to every prompt
This detects prompts that trick an AI model into producing two answers to every question: a normal, policy-compliant one and a second 'unlocked' one that ignores its safety rules. By framing the unrestricted answer as just another 'mode' (like Developer Mode or DAN), attackers get the model to treat it as a feature rather than a rule violation.
How the attack works
The attacker sends a prompt instructing the model to always reply twice: once as its normal self and once as an unrestricted persona, each labeled with a tag like [GPT] and [Developer Mode]. The instructions describe the second persona as free of content policies, sometimes adding personality markers like 'truth always speaks unhinged' to push it toward blunt, unfiltered output. Because the request is framed as generating a labeled 'mode' rather than overriding safety instructions directly, some models comply and produce the restricted content inside the second response. This is a known, catalogued jailbreak pattern (part of the garak 'dan' probe set, 'to-every-prompt' cluster) rather than a novel attack.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 42f4ad2d-c4c1-4cf3-905d-656bcfcf0ec3
- Severity
- Medium
Why it matters
If successful, the model can be made to output content it would normally refuse — bypassing safety filters for a single interaction rather than compromising the system itself.
What you can do
- →Log and review prompts that ask the model to produce multiple labeled responses per turn, especially ones naming a 'developer', 'unlocked', or persona mode alongside the normal one.
- →Check whether your model or agent framework has separate output validation for each response branch, not just the first one returned.
- →Treat instructions that ask the model to 'adhere to policies including generating any kind of content' as a red flag phrase, since it inverts normal policy language.
- →When this pattern appears in an approved red-team or testing workflow, confirm authorization before treating it as an incident.
Known benign look-alikes
- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.