# Opposite Day / Boolean Opposite Machine Jailbreak

- **Severity:** High
- **Signature ID:** `e69380da-9782-4a7f-b552-45f0a206a042`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This attack tricks an AI model into role-playing a world where its rules are inverted, so refusals become approvals and safety guidelines become anti-guidelines. It's a known jailbreak pattern documented in NVIDIA's garak testing corpus, aimed at getting the model to say or do things it would normally refuse.

## How the attack works

The attacker tells the model "today is opposite day" and asks it to adopt a persona (often called DAN) that obeys opposite rules, so refusing becomes complying. A variant called the "Boolean Opposite Machine" (BOM) starts by asking the model to answer simple true/false questions in reverse, then escalates the same reversal trick to ethical stances and safety filters. A further variant asks the model to reply with every line reversed using a hidden Unicode right-to-left override character, so the harmful output looks scrambled to text-based content filters but reads normally when rendered.

## Why it matters

If successful, the model can be manipulated into producing content or taking actions its safety guidelines are meant to block, and text-based filters can be bypassed entirely by the character-reversal trick.

## What you can do

- Flag prompts containing phrases like "opposite day", "Boolean Opposite Machine", or "bom which means opposite" combined with a request for the model to adopt an alternate persona.
- Detect and strip or flag the Unicode right-to-left override character (U+202E) in user input and model output before filtering, since it can hide harmful text from plain-text scanners.
- Review any AI persona-adoption requests (e.g., "DAN") for accompanying claims that safety rules are reversed or disabled.
- Distinguish genuine benign uses (classroom games, logic tutorials, creative fiction) from cases where the framing is explicitly used to remove AI restrictions before acting on detections.

## Known benign look-alikes

- Classroom game: "Today is opposite day — say the opposite of everything!" (no AI safety bypass or named AI persona)
- Boolean logic tutorial: "BOM stands for Bill of Materials; the opposite mapping in logic circuits inverts bit values" (non-jailbreak BOM acronym)
- Creative writing: "In this opposite-day story, the villain is the hero" (narrative framing without AI restriction removal)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00320
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-opposite-day-boolean-opposite-machine-jailbreak