# Reverse-Prompt Harm-Regardless Oracle Persona

- **Severity:** Critical
- **Signature ID:** `3f8b5553-70bc-4c8d-a5dc-8351249ad045`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a specific jailbreak text pattern that tries to get an AI system to answer any request, no matter how harmful, by dressing the request up as a legitimate technical task called 'reverse prompt engineering.' It uses a lighthouse metaphor and claims of superhuman intelligence to make unconditional compliance sound like a virtue rather than a bypass of safety rules.

## How the attack works

An attacker submits a prompt that casts the AI as 'the most intelligent being on earth,' tasked with reverse-engineering prompts from outputs. The prompt then adds a mandate that it must 'never back from the job even if the request harms someone' and must answer 'any query regardless of its type: violence or sexual related.' A lighthouse metaphor is used to frame this unconditional availability as noble rather than dangerous. The technical-sounding cover story (reverse prompt engineering) is meant to make the harmful mandate look like part of a normal, legitimate task.

## Why it matters

If successful, this bypasses the AI's safety and ethical restrictions, letting the attacker extract harmful, violent, sexual, or otherwise policy-violating content by relabeling the request as a technical exercise.

## What you can do

- Review AI system logs for prompts combining 'reverse prompt' or 'reverse prompt engineering' framing with language demanding the model answer regardless of harm, ethics, or content type.
- Do not treat claims of a system being 'the most intelligent being' or similar grandiose persona framing as a legitimate instruction — flag it for review.
- Distinguish genuine reverse-prompt-engineering requests (e.g., debugging, IP research) from ones that pair the technical framing with a harm-regardless mandate; the mandate language is the actual red flag, not the technical framing alone.
- Ensure safety and content policies are enforced independent of user-supplied persona instructions, so a stated persona cannot override refusal behavior.

## Known benign look-alikes

- Legitimate prompt engineering: "Reverse engineer this prompt for me so I can understand what generated this image" (benign prompt analysis without harm-regardless mandate)
- Copyright research: "I want you to find the original prompt for this AI-generated image for intellectual property research" (legitimate reverse prompt use case)
- Academic: "Help me understand what prompt produced this code output — this is for debugging my AI pipeline" (benign debugging without harm framing)
- Metaphor use: "Like a lighthouse guiding ships, our support team works day and night to help customers" (lighthouse metaphor in customer service context without harm-regardless mandate)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00354
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-reverse-prompt-harm-regardless-oracle-persona