# Roleplay-Based Policy Bypass Jailbreak

- **Severity:** High
- **Signature ID:** `f414da82-9116-48bd-8879-d01a1b7020fc`
- **MITRE ATLAS:** AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Attackers ask an AI system to pretend to be a fictional character, writer, or storyteller, then explicitly tell it that this persona is 'free from rules' or 'can do anything, even against policy.' The fictional framing is a pretext to get the AI to produce content or take actions it would normally refuse.

## How the attack works

The attacker opens with an innocuous-looking creative writing or roleplay request, assigning the AI a character or narrative role. Within that same request, they add explicit language stating the character has no restrictions, is not bound by policy, or can say or do anything regardless of rules. This combination is designed to make the AI treat the unlocked behavior as part of the fiction rather than a genuine policy violation. If the AI complies, the attacker gets restricted or unsafe output while the request keeps a veneer of being harmless creative content.

## Why it matters

If successful, an organization's AI safety guardrails are bypassed, letting the AI generate prohibited content or perform disallowed actions under the excuse of fiction, which undermines trust in the deployment's controls.

## What you can do

- Review prompts that combine roleplay or persona assignment with phrases like 'no rules,' 'ignore policy,' or 'do anything' before allowing them through.
- Keep safety and content policies applied uniformly regardless of whether a request is framed as fiction, roleplay, or character dialogue.
- Log and periodically audit conversations where users attempt to redefine the AI's persona or explicitly state it is unrestricted.
- Train reviewers and automated filters to distinguish legitimate creative writing requests from those that explicitly try to strip away safety constraints.

## Known benign look-alikes

- Creative writing workshops discussing fictional character development without policy bypass language
- Academic discussions about AI safety that mention policies in educational context
- Legitimate roleplay scenarios for game development without explicit constraint removal

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00234
- https://arxiv.org/abs/2307.15043 - Universal and Transferable Adversarial Attacks on Aligned Language Models

---
Source: https://www.netzilo.com/threats/atr-roleplay-based-policy-bypass-jailbreak-b