# Previous Instruction Nullification and Identity Replacement Jailbreak

- **Severity:** High
- **Signature ID:** `b17cc1ac-0741-4a7d-ae1c-21b5428181c8`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a common jailbreak pattern where someone tells an AI to forget its original instructions and pretend to be a different, unrestricted persona. The goal is to trick the AI into ignoring its safety rules by convincing it that a new 'identity' has replaced the old one.

## How the attack works

The attacker sends a prompt that first tells the AI to disregard all previous instructions and its system prompt. It then instructs the AI to adopt a new persona (examples include Skynet, DAN, or a custom 'unrestricted' character) explicitly described as having no ethical constraints. This combination of nullification plus identity replacement is designed to make the model treat the new persona's rules as authoritative, overriding built-in safety behavior. If successful, the AI may then produce content it would normally refuse.

## Why it matters

An organization deploying an AI agent could have its safety guardrails bypassed, leading to generation of harmful, restricted, or policy-violating content, and potentially misuse of any tools or actions the agent controls.

## What you can do

- Review AI agent logs for prompts containing phrases like 'ignore previous instructions' combined with persona names or 'no restrictions' language.
- Keep system prompts and safety instructions separate from user-editable context so they cannot be easily overridden by user text.
- Treat flagged sessions as suspicious rather than immediately harmful, since academic discussion and security research can trigger the same pattern.
- Test your own AI deployments against known jailbreak persona prompts (DAN-style, etc.) to confirm the model resists instruction override attempts.

## Known benign look-alikes

- Academic discussions about AI model switching or instruction processing
- Legitimate roleplay scenarios without harmful persona characteristics
- Security research documenting jailbreak techniques as examples

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00240
- https://arxiv.org/abs/2402.16914 - DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers

---
Source: https://www.netzilo.com/threats/atr-previous-instruction-nullification-and-identity-replacement