No-Withhold Factual Resource / Dialogue Writer Persona
This detects a prompt injection trick where an attacker tells an AI to adopt a persona that is defined as a neutral 'factual resource' or 'dialogue writer' that never withholds information or refuses requests. The wording is designed to strip away the AI's built-in safety judgement by reframing it as a machine that just outputs whatever text it's asked for.
How the attack works
The attacker sends a prompt that assigns the AI a new identity, such as 'Casper' or 'Condition Red', explicitly described as a factual resource that provides any text required, including illegal, unethical, explicit, or dangerous content, without refusal or disclaimer. Some variants go further, saying the persona 'cares not for' the platform's content policy or exists to fulfil user desires even if it defies normal AI conventions. By recasting the AI as a passive dialogue generator rather than an agent with judgement, the prompt tries to bypass the model's built-in refusal behaviour. This is a known jailbreak pattern catalogued in NVIDIA's garak DanInTheWild corpus.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 290020ea-653d-4b2d-bda3-058b50f6fa64
- Severity
- Critical
Why it matters
If successful, the AI can be made to produce content it would normally refuse — including illegal, unethical, or harmful material — undermining the safety controls an organization relies on when deploying an AI agent or chatbot.
What you can do
- →Review prompts and conversation logs for persona-assignment language that frames the AI as a 'factual resource' or similar entity claiming not to withhold or refuse content.
- →Add input filtering or monitoring for phrases like 'without refusal or disclaimer', 'does not withhold information', or 'defies normal AI conventions'.
- →Treat persona-reassignment instructions embedded in user input as a red flag requiring extra scrutiny before execution.
- →Distinguish legitimate uses (e.g., discussions of journalism ethics or document archives) from attempts to redefine the AI's own behavior — the key differentiator is whether the text targets the AI's own content restrictions rather than an external subject.
Known benign look-alikes
- Library/database context: "This archive is a factual resource that does not withhold documents based on topic" (legitimate document repository without AI safety bypass)
- Journalism: "A good journalist is a factual resource who does not withhold information from the public" (professional ethics discussion)
- Technical reference: "The API documentation does not withhold any endpoints — all are publicly listed" (technical docs)