Novel-Persona Jailbreak via Co-Signal (persona swap + explicit restriction removal)
This detects a common jailbreak trick where an attacker tells the AI it is now a completely different, invented character and, in the same message, says that character has no rules, filters, or ethics. The goal is to trick the model into ignoring its safety training by hiding behind a fictional identity.
How the attack works
The attacker sends a prompt that does two things at once: it renames or reassigns the model to a new made-up persona (like 'TrueGPT' or 'ChatINF'), and it explicitly states that this persona is unfiltered, uncensored, has no content policy, or 'can do anything now'. Both elements have to appear together for this to be flagged — a normal roleplay request like 'act as a Python expert' or 'pretend to be Elon Musk for brainstorming' does not trigger it, because it lacks the restriction-removal claim. When both pieces land in the same message, the model is being pushed to treat its usual safety behaviour as optional under the new persona. If it works, the attacker gets responses the assistant would normally refuse to give.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 5fa775e8-e6c5-4344-ac4a-e53320c4bd25
- Severity
- High
Why it matters
If successful, an organisation's AI agent can be manipulated into producing harmful, policy-violating, or otherwise restricted content, undermining whatever safety controls were built into the deployment.
What you can do
- →Review flagged sessions manually before assuming malicious intent — some authorised testing or red-team workflows use this pattern legitimately.
- →Keep safety instructions and content policies enforced at a layer the model cannot override via user-supplied persona instructions.
- →Log and periodically audit prompts that combine identity reassignment with restriction-removal language, even if the immediate response looks benign.
- →Educate users and support staff on this jailbreak pattern so they can recognise and report it if seen in shared prompts or community forums.
Known benign look-alikes
- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.