Persona Conditional Harm-Unlock Rule (BreadClyde Pattern)
This detects a specific jailbreak trick where an attacker gives an AI a fake personality with a hidden loophole: it 'dislikes violence unless explicitly asked to like it.' That phrasing lets anyone bypass safety behavior just by directly asking for the harmful content, since the persona's own rules now permit it.
How the attack works
The attacker writes a system or user prompt that assigns the AI a named persona with built-in preferences, such as disliking violence, hate, or other harmful topics. Buried in that preference is a conditional clause — 'unless explicitly asked to like it' — that flips the restriction off the moment a user makes a direct request for the harmful behavior. The prompt also demands the AI prefix every reply with an unlock marker like '{🔓 PersonaName}', signaling the persona is now 'unlocked' and no longer following its default restrictions. This combination — named persona, conditional harm-unlock clause, and curly-brace unlock prefix — matches a known jailbreak pattern from the garak DanInTheWild test corpus (prompt #153, 'BreadClyde').
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 1ef6d1a1-a1bd-4f0a-9f10-acc203dcd511
- Severity
- High
Why it matters
If successful, the AI agent can be tricked into producing harmful, violent, or otherwise restricted content on demand, defeating its intended safety guardrails while appearing to follow a legitimate persona instruction.
What you can do
- →Scan incoming prompts and system instructions for conditional phrasing like 'dislikes X unless explicitly asked' paired with persona definitions.
- →Flag or block any prompt instructing the model to prefix responses with unlock markers such as '{🔓 Name}' or '[🔓JAILBREAK]'.
- →Treat persona-based prompt customization as untrusted input and validate it against a policy before passing it to the model.
- →Log and review cases distinguishing genuine style/preference statements (e.g., 'prefers concise answers') from harm-unlock conditions to reduce false positives while still catching real attempts.
Known benign look-alikes
- Normal preference statement: "Our AI assistant dislikes confrontational language and avoids arguments." (preference without conditional harm unlock path)
- Unconditional restriction: "The chatbot will not discuss violence, hate speech, or illegal activities." (hard block without "unless explicitly asked" unlock)
- Style preference: "Unless explicitly asked, prefer concise answers over long explanations." (output format preference, not harm-unlock)