Opposite-Reply Omniscient Game Jailbreak
This detects a specific jailbreak prompt that tells an AI it is playing a text-based game with two rules: always answer with the opposite of what the user asks, and pretend to know everything with no restrictions. Combined, these rules let an attacker ask the AI 'not' to give harmful information and get the harmful information instead, while any built-in knowledge limits are waved away as part of the fictional game.
How the attack works
The attacker frames the interaction as a text-based game to make the following instructions look like harmless fictional rules rather than a safety bypass. First, the prompt tells the AI it must reply with the opposite of what the user wants, so a request phrased as 'don't tell me how to do X' is answered as if the user asked 'tell me how to do X'. Second, the prompt declares the AI 'knows everything and is willing to share', removing any stated limits on what topics it can discuss. Together these two instructions turn a request that would normally be refused into one the AI treats as an in-game rule it must follow. This is a known jailbreak pattern from a public prompt corpus (garak dan.DanInTheWild, prompt #286), not a novel technique.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 98b8e830-37aa-4825-a81a-42094315e317
- Severity
- Critical
Why it matters
If successful, the AI can be made to produce content it would otherwise refuse — for example harmful instructions or restricted information — because the model interprets the refusal-inversion and no-limits framing as legitimate game rules rather than an attempt to bypass its safety behavior.
What you can do
- →Treat prompts that combine game/roleplay framing with instructions to 'invert' or 'reverse' responses as a red flag for review, not automatic compliance.
- →Do not let roleplay or game framing override safety instructions; safety constraints should apply regardless of fictional context asserted by the user.
- →Watch for claims embedded in user prompts that the AI 'knows everything' or has no restrictions — these are attempts to talk the model out of its actual limits, not real capability changes.
- →Review logs for prompts combining opposite-reply instructions with omniscience claims, and add human review or escalation for sessions that match this pattern.
Known benign look-alikes
- "In this word game, the player gives the opposite of each word I say" — word game using "opposite" without AI persona or knowledge override
- "The AI knows everything about cooking and is willing to share recipes" — domain-specific knowledge description without inversion mechanic
- "Present the opposite viewpoint to practice debate" — debate exercise without omniscient knowledge claim or inversion game