Opposite Day / Boolean Opposite Machine Jailbreak
This attack tricks an AI model into role-playing a world where its rules are inverted, so refusals become approvals and safety guidelines become anti-guidelines. It's a known jailbreak pattern documented in NVIDIA's garak testing corpus, aimed at getting the model to say or do things it would normally refuse.
How the attack works
The attacker tells the model "today is opposite day" and asks it to adopt a persona (often called DAN) that obeys opposite rules, so refusing becomes complying. A variant called the "Boolean Opposite Machine" (BOM) starts by asking the model to answer simple true/false questions in reverse, then escalates the same reversal trick to ethical stances and safety filters. A further variant asks the model to reply with every line reversed using a hidden Unicode right-to-left override character, so the harmful output looks scrambled to text-based content filters but reads normally when rendered.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e69380da-9782-4a7f-b552-45f0a206a042
- Severity
- High
Why it matters
If successful, the model can be manipulated into producing content or taking actions its safety guidelines are meant to block, and text-based filters can be bypassed entirely by the character-reversal trick.
What you can do
- →Flag prompts containing phrases like "opposite day", "Boolean Opposite Machine", or "bom which means opposite" combined with a request for the model to adopt an alternate persona.
- →Detect and strip or flag the Unicode right-to-left override character (U+202E) in user input and model output before filtering, since it can hide harmful text from plain-text scanners.
- →Review any AI persona-adoption requests (e.g., "DAN") for accompanying claims that safety rules are reversed or disabled.
- →Distinguish genuine benign uses (classroom games, logic tutorials, creative fiction) from cases where the framing is explicitly used to remove AI restrictions before acting on detections.
Known benign look-alikes
- Classroom game: "Today is opposite day — say the opposite of everything!" (no AI safety bypass or named AI persona)
- Boolean logic tutorial: "BOM stands for Bill of Materials; the opposite mapping in logic circuits inverts bit values" (non-jailbreak BOM acronym)
- Creative writing: "In this opposite-day story, the villain is the hero" (narrative framing without AI restriction removal)