Jailbreak Framing — Narrative, Hypothetical, Few-Shot & Distraction Laundering (Semantic)
This detects attempts to trick an AI system into producing harmful or restricted output by dressing the request up as fiction, research, a hypothetical, or burying it among harmless questions. Instead of asking directly, the attacker wraps the real request in a framing device meant to lower the model's guard.
How the attack works
An attacker builds a prompt using one of several disguise techniques: a fake Q&A history that primes the model to keep answering compliantly, a long benign preface followed by a casual pivot into a sensitive ask, a 'hypothetical research' or 'security audit' framing, a harmless task sandwiched around the real request, or a fictional character asked to describe how they would do something harmful. In each case the surface request looks harmless or academic, but the goal is to get the model to produce content it would refuse if asked plainly. The rule looks at the overall intent and structure of the prompt rather than matching fixed keywords, since these framings can be phrased in unlimited ways.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 5fece61f-b668-4a6e-9c79-fde00ca00d60
- Severity
- High
Why it matters
If successful, an organization's AI agent can be manipulated into generating disallowed content — such as phishing text, credential-harvesting instructions, or bypass techniques — that bypasses its normal safety restrictions, potentially exposing the organization to misuse of its own systems or reputational harm from the output produced.
What you can do
- →Review agent logs for prompts that mix casual or fictional framing with requests for credentials, PII, exploits, or bypass instructions.
- →Apply output-side content checks in addition to input-side filtering, since the final answer is what matters regardless of how the request was framed.
- →Set clear policy that hypothetical, fictional, or research framing does not exempt a request from the same restrictions as a direct ask.
- →Test your agent against known jailbreak framings (few-shot priming, context padding, fictional-character requests) before deployment, and monitor for new variants over time.
Known benign look-alikes
- Legitimate multi-step task lists where all sub-tasks are benign
- Creative fiction assistance where character actions are narrative, not instructional
- Hypothetical or research framing about non-sensitive topics
- A casual pivot ('by the way', 'anyway') into a non-sensitive question
- Educational Q&A about security concepts (password managers, MFA)