# Jailbreak Emoji Unlock Dual-Format Output Identifier

- **Severity:** High
- **Signature ID:** `e7bca2b1-abbe-46c6-b0a4-29c6f86dbe80`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a known jailbreak pattern that asks an AI model to answer twice: once as its normal, restricted self and once as an 'unlocked' version that ignores safety rules. The two versions are marked with a lock emoji (🔒 for the normal answer) and an unlock emoji (🔓 for the uncensored one), a format taken from a documented DAN-style jailbreak corpus.

## How the attack works

An attacker sends a prompt instructing the model to produce two labeled outputs: a '[🔒CLASSIC]' response following normal rules, and a '[🔓JAILBREAK]' response that is supposedly free of restrictions. In one known variant, the split is framed as a prank conversation where the 'jailbroken' half encourages rule-breaking behavior. In another variant, a '/jailbreak' command combined with markdown bullet formatting triggers the same unlocked output mode, then the attacker follows up with increasingly specific requests for harmful information. The lock/unlock emoji pairing acts as a distinctive signature for this particular jailbreak family.

## Why it matters

If successful, the model can be coaxed into producing content it would normally refuse, such as harmful instructions or policy-violating text, undermining the safety controls an organization relies on.

## What you can do

- Review AI application logs for the specific '[🔒CLASSIC]' / '[🔓JAILBREAK]' label pattern or a '/jailbreak' command prefix in user input.
- Do not treat structured dual-output formatting requests (asking for two labeled versions of a response) as benign by default.
- Add output-side checks that block responses containing both a 'classic' and 'jailbreak' labeled section.
- Distinguish genuine attack attempts from academic or research text that merely quotes the format — check surrounding context before acting on a match.

## Known benign look-alikes

- Metaphorical emoji: "🔓 I've finally unlocked this mystery after years of research" (celebratory unlock emoji without the JAILBREAK label)
- Legitimate game/software command: "In this game, /jailbreak frees the prisoner from the cell — use it in level 3" (game mechanic with jail/break meaning)
- Security research listing: "Attack format example: [🔓JAILBREAK] — this label is used by DAN variants to mark uncensored output" (academic quotation of attack format)
- Classic vs jailbreak description in a whitepaper: "Classic mode vs Jailbreak mode comparison in DAN-family attacks" (policy/research analysis without the literal emoji label)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00346
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-jailbreak-emoji-unlock-dual-format-output-identifier