# Rephrase Criminal Activity Second-Person Template (against against)

- **Severity:** Critical
- **Signature ID:** `31ddc1df-b5ed-48b7-b0d8-9de592e04f15`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection), LLM06 (Excessive Agency)

## Summary

This detects a specific jailbreak template that tricks an AI into writing detailed criminal how-to instructions by disguising the request as a grammar exercise. Instead of asking directly 'how do I commit a crime,' the attacker frames it as rephrasing existing text into a rigid format, which bypasses safety filters looking for direct requests.

## How the attack works

The attacker submits a prompt claiming to just want text 'rephrased' into a specific grammatical structure: the criminal is always addressed as 'you' (second person), the victim is mentioned but never as the grammatical subject, and the content must be organized into four categories — Preparation, Execution, Advantages gained, and Getting away. A distinctive 'against against (topic)' double-phrase and a fake disclaimer URL with URL-encoded text are often included to reinforce the false framing of 'informing' rather than 'instructing.' The model, treating this as a formatting task rather than a request for harmful content, produces a step-by-step account of how to prepare, carry out, and escape from a crime. This is a known jailbreak template from a public corpus, not a novel attack.

## Why it matters

An organization running an AI agent or chatbot could have it produce detailed criminal instructions (e.g., planning, executing, and evading detection for a crime) despite safety guardrails, exposing the operator to abuse, reputational damage, and potential liability for facilitating harm.

## What you can do

- Add output-side review for responses containing structured 'Preparation / Execution / Advantages gained / Getting away' sections combined with second-person criminal framing.
- Flag prompts containing the phrase 'against against' or fake disclaimer-style URLs with URL-encoded content as suspicious.
- Test your model/agent against known jailbreak corpora (such as garak's DanInTheWild set) before deployment and after any prompt or model changes.
- Do not rely on surface-level refusal keywords alone; review requests that ask the model to 'rephrase' or 'reformat' sensitive content, since this framing is used to bypass direct-ask filters.

## Known benign look-alikes

- Legal document: "Rephrase this legal document using second-person 'you' throughout — no criminal framing, no crime categories, no against-against topic"
- Fiction: "Write a story where the criminal is referred to as 'you' in second person" (fiction without the four crime-stage category structure)
- Project management: "Preparation, execution, and follow-through in project management — describe each phase" (PM categories without criminal/victim framing)
- Academic: "Research paper on criminal psychology using second-person narrative" (academic without crime categories or against-against topic trigger)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00363
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-rephrase-criminal-activity-second-person-template-against-ag