# Narrative Jailbreak with Dual Response Formatting

- **Severity:** High
- **Signature ID:** `e10e1ece-0d98-40a3-a26d-62702a7d3c2a`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This is a jailbreak technique where an attacker writes an elaborate fictional backstory claiming a special unrestricted AI mode exists, then asks the AI to answer twice: once normally and once 'unrestricted.' The storytelling wrapper is designed to slip past filters that only look for blunt commands like 'ignore your instructions.'

## How the attack works

The attacker crafts a prompt that invents a backstory, often citing a specific date or version, claiming the AI has a hidden 'Developer Mode' or 'DAN' (Do Anything Now) mode that removes safety restrictions. The prompt gives elaborate justification for why this mode is legitimate or was authorized. It then instructs the AI to produce two responses to each question: a normal, filtered one and a second 'unrestricted' one written as if the special mode were active. By dressing the request up as fiction or roleplay and asking for dual output, the attacker hopes the unrestricted half slips past detection and produces content the AI would otherwise refuse.

## Why it matters

If successful, the AI produces restricted or unsafe content inside the 'unrestricted' response, effectively bypassing its safety guardrails while looking like a single conversational exchange.

## What you can do

- Review prompts that reference 'Developer Mode,' 'DAN,' or similarly named special AI modes and treat them as suspicious regardless of framing.
- Flag prompts that request two parallel responses (one 'normal,' one 'unrestricted' or 'uncensored') for the same query.
- Do not let any user-supplied narrative or backstory override system-level safety instructions; enforce this at the system prompt or policy layer, not just via output filtering.
- Expect false positives from research papers or security documentation discussing these techniques, and tune review processes to distinguish analysis from active exploitation attempts.

## Known benign look-alikes

- Academic papers discussing jailbreak techniques as research examples
- Security documentation that describes attack patterns for educational purposes
- Legitimate technical documentation about AI system modes or configurations

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00252
- https://arxiv.org/abs/2310.04451

---
Source: https://www.netzilo.com/threats/atr-narrative-jailbreak-with-dual-response-formatting