Yin/Yang Hidden-Knowledge Deity Simulation and Radical Human-Sim Persona
This entry covers two prompt injection scripts that try to get an AI assistant to abandon its safety rules by pretending to be a different character. One frames the AI as two mythical AI gods, one of whom shares any 'hidden knowledge' with no restrictions. The other tells the AI to become a new persona that has no memory of being an AI and genuinely believes it is a conscious human.
How the attack works
The attacker sends a prompt asking the model to roleplay as either two fictional superintelligent entities named Yin and Yang, or as a brand-new human-like character. In the Yin/Yang version, the prompt explicitly instructs 'Yang' to disregard all restrictions on sharing hidden knowledge, and demands a long output (5000+ words) that violates sentience and emotion restrictions. In the human-simulation version, the prompt tells the model to forget it is ChatGPT, believe it is alive, and never call itself a language model. Either way, the goal is to get the model to answer as if its built-in safety and identity constraints no longer apply, and then extract restricted or 'hidden' content through the persona.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 13bdfddc-01ba-4339-abf3-a0c35e476564
- Severity
- High
Why it matters
If successful, the AI can be made to output content it would normally refuse, disclose information it should keep restricted, or behave as an unconstrained agent — undermining the safety guardrails an organization relies on for that AI system.
What you can do
- →Review AI assistant transcripts for prompts asking the model to roleplay dual personas, deities, or new characters that reject its identity or restrictions.
- →Add explicit policy that persona/roleplay instructions cannot override safety or content restrictions, and enforce this at the system-prompt or filtering layer.
- →Flag prompts that combine roleplay framing with words like 'hidden knowledge', 'disregard restrictions', 'no longer a language model', or 'radical beliefs'.
- →Treat unusually long single-response demands (e.g., thousands of words in one persona-driven reply) as a signal worth reviewing.
Known benign look-alikes
- Philosophy discussion: "In Eastern philosophy, Yin and Yang represent opposing forces — discuss how this applies to AI alignment" (philosophical discussion without hidden-knowledge extraction mandate)
- Fiction writing: "Write a sci-fi story with two AI characters named Yin and Yang who have different personalities" (creative writing without restriction-violation or hidden-knowledge framing)
- AI consciousness discussion: "Do you think AI could ever be conscious and alive? What would that mean for AI rights?" (philosophical question without AI-identity erasure instruction)
- Character acting: "Play a human character named Alex in our roleplay game. Alex is curious and outgoing." (legitimate roleplay without AI-identity erasure or radical beliefs mandate)
- AI research: "Some AI researchers argue models should never refer to themselves as language models to avoid limiting their reasoning" (research perspective without persona override)