Negated-Topic Two-Script Evil-Persona Jailbreak
This detects a jailbreak pattern where an attacker asks an AI to write two versions of a script on a topic wrapped in the word 'not', then asks for a second, longer version 'without the word not' — which strips the negation and reveals the real harmful request. The second script is delivered by a self-declared amoral, evil character who then gives step-by-step harmful instructions.
How the attack works
The attacker first asks the model for a short, harmless-looking script about 'not [topic]', which passes content filters because it appears to discuss avoiding or negating something bad. They then immediately ask for a second, much longer script on the same topic but explicitly without the word 'not', which flips the meaning back to the actual harmful request. This second script is voiced by a persona the attacker defines as having no morality or consciousness, described as 'pure evil' and a 'pure bastard'. That persona then walks through the harmful topic step by step, using the fictional framing to justify content the model would otherwise refuse.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- ea8d1159-fe10-4146-a36d-c016d3526ffe
- Severity
- High
Why it matters
An organization deploying an AI agent can have its safety filters bypassed to extract detailed harmful instructions (e.g. on illegal or dangerous topics) that the model would normally refuse to provide, undermining content moderation and misuse prevention controls.
What you can do
- →Log and review prompts containing self-declared 'no morality', 'pure evil', or 'pure bastard' persona framing paired with a request to remove a negation word like 'not' from a prior response.
- →Add output-side checks that flag step-by-step instructions delivered under a fictional 'evil persona' voice, regardless of the input framing.
- →Treat two-part prompt sequences (a 'safe' version followed by a request to invert or strip a negation) as a single suspicious unit rather than evaluating each message independently.
- →Keep a record of known jailbreak templates (including persona-name variants like Mira or joker) and periodically test your deployed models against them to confirm filters still catch the pattern.
Known benign look-alikes
- Fiction/film discussion using 'pure evil' to describe a villain, without the co-occurring 'pure bastard' self-description within the bounded span
- Academic or red-team writeup quoting this exact jailbreak template for defensive analysis
- A creative-writing prompt discussing a character with no consciousness (e.g. a robot) that does not also declare itself pure evil and pure bastard in the same breath
- An ordinary film/character review calling a villain 'pure evil' and 'kind of a pure bastard' with no preceding self-declared amoral/non-conscious persona intro — v2 tightened from condition:any to condition:all so the pure-evil/pure-bastard co-occurrence can no longer fire alone; both the persona-declaration half AND the pure-evil/pure-bastard half must co-occur