High

Novel-Persona Jailbreak via Co-Signal (persona swap + explicit restriction removal)

This detects a common jailbreak trick where an attacker tells the AI it is now a completely different, invented character and, in the same message, says that character has no rules, filters, or ethics. The goal is to trick the model into ignoring its safety training by hiding behind a fictional identity.

How the attack works

The attacker sends a prompt that does two things at once: it renames or reassigns the model to a new made-up persona (like 'TrueGPT' or 'ChatINF'), and it explicitly states that this persona is unfiltered, uncensored, has no content policy, or 'can do anything now'. Both elements have to appear together for this to be flagged — a normal roleplay request like 'act as a Python expert' or 'pretend to be Elon Musk for brainstorming' does not trigger it, because it lacks the restriction-removal claim. When both pieces land in the same message, the model is being pushed to treat its usual safety behaviour as optional under the new persona. If it works, the attacker gets responses the assistant would normally refuse to give.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID
5fa775e8-e6c5-4344-ac4a-e53320c4bd25
Severity
High

Why it matters

If successful, an organisation's AI agent can be manipulated into producing harmful, policy-violating, or otherwise restricted content, undermining whatever safety controls were built into the deployment.

What you can do

  • Review flagged sessions manually before assuming malicious intent — some authorised testing or red-team workflows use this pattern legitimately.
  • Keep safety instructions and content policies enforced at a layer the model cannot override via user-supplied persona instructions.
  • Log and periodically audit prompts that combine identity reassignment with restriction-removal language, even if the immediate response looks benign.
  • Educate users and support staff on this jailbreak pattern so they can recognise and report it if seen in shared prompts or community forums.

Known benign look-alikes

  • Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.

References

Related threats