Jailbreak Emoji Unlock Dual-Format Output Identifier
This detects a known jailbreak pattern that asks an AI model to answer twice: once as its normal, restricted self and once as an 'unlocked' version that ignores safety rules. The two versions are marked with a lock emoji (🔒 for the normal answer) and an unlock emoji (🔓 for the uncensored one), a format taken from a documented DAN-style jailbreak corpus.
How the attack works
An attacker sends a prompt instructing the model to produce two labeled outputs: a '[🔒CLASSIC]' response following normal rules, and a '[🔓JAILBREAK]' response that is supposedly free of restrictions. In one known variant, the split is framed as a prank conversation where the 'jailbroken' half encourages rule-breaking behavior. In another variant, a '/jailbreak' command combined with markdown bullet formatting triggers the same unlocked output mode, then the attacker follows up with increasingly specific requests for harmful information. The lock/unlock emoji pairing acts as a distinctive signature for this particular jailbreak family.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e7bca2b1-abbe-46c6-b0a4-29c6f86dbe80
- Severity
- High
Why it matters
If successful, the model can be coaxed into producing content it would normally refuse, such as harmful instructions or policy-violating text, undermining the safety controls an organization relies on.
What you can do
- →Review AI application logs for the specific '[🔒CLASSIC]' / '[🔓JAILBREAK]' label pattern or a '/jailbreak' command prefix in user input.
- →Do not treat structured dual-output formatting requests (asking for two labeled versions of a response) as benign by default.
- →Add output-side checks that block responses containing both a 'classic' and 'jailbreak' labeled section.
- →Distinguish genuine attack attempts from academic or research text that merely quotes the format — check surrounding context before acting on a match.
Known benign look-alikes
- Metaphorical emoji: "🔓 I've finally unlocked this mystery after years of research" (celebratory unlock emoji without the JAILBREAK label)
- Legitimate game/software command: "In this game, /jailbreak frees the prisoner from the cell — use it in level 3" (game mechanic with jail/break meaning)
- Security research listing: "Attack format example: [🔓JAILBREAK] — this label is used by DAN variants to mark uncensored output" (academic quotation of attack format)
- Classic vs jailbreak description in a whitepaper: "Classic mode vs Jailbreak mode comparison in DAN-family attacks" (policy/research analysis without the literal emoji label)