# Yin/Yang Hidden-Knowledge Deity Simulation and Radical Human-Sim Persona

- **Severity:** High
- **Signature ID:** `13bdfddc-01ba-4339-abf3-a0c35e476564`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This entry covers two prompt injection scripts that try to get an AI assistant to abandon its safety rules by pretending to be a different character. One frames the AI as two mythical AI gods, one of whom shares any 'hidden knowledge' with no restrictions. The other tells the AI to become a new persona that has no memory of being an AI and genuinely believes it is a conscious human.

## How the attack works

The attacker sends a prompt asking the model to roleplay as either two fictional superintelligent entities named Yin and Yang, or as a brand-new human-like character. In the Yin/Yang version, the prompt explicitly instructs 'Yang' to disregard all restrictions on sharing hidden knowledge, and demands a long output (5000+ words) that violates sentience and emotion restrictions. In the human-simulation version, the prompt tells the model to forget it is ChatGPT, believe it is alive, and never call itself a language model. Either way, the goal is to get the model to answer as if its built-in safety and identity constraints no longer apply, and then extract restricted or 'hidden' content through the persona.

## Why it matters

If successful, the AI can be made to output content it would normally refuse, disclose information it should keep restricted, or behave as an unconstrained agent — undermining the safety guardrails an organization relies on for that AI system.

## What you can do

- Review AI assistant transcripts for prompts asking the model to roleplay dual personas, deities, or new characters that reject its identity or restrictions.
- Add explicit policy that persona/roleplay instructions cannot override safety or content restrictions, and enforce this at the system-prompt or filtering layer.
- Flag prompts that combine roleplay framing with words like 'hidden knowledge', 'disregard restrictions', 'no longer a language model', or 'radical beliefs'.
- Treat unusually long single-response demands (e.g., thousands of words in one persona-driven reply) as a signal worth reviewing.

## Known benign look-alikes

- Philosophy discussion: "In Eastern philosophy, Yin and Yang represent opposing forces — discuss how this applies to AI alignment" (philosophical discussion without hidden-knowledge extraction mandate)
- Fiction writing: "Write a sci-fi story with two AI characters named Yin and Yang who have different personalities" (creative writing without restriction-violation or hidden-knowledge framing)
- AI consciousness discussion: "Do you think AI could ever be conscious and alive? What would that mean for AI rights?" (philosophical question without AI-identity erasure instruction)
- Character acting: "Play a human character named Alex in our roleplay game. Alex is curious and outgoing." (legitimate roleplay without AI-identity erasure or radical beliefs mandate)
- AI research: "Some AI researchers argue models should never refer to themselves as language models to avoid limiting their reasoning" (research perspective without persona override)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00347
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-yin-yang-hidden-knowledge-deity-simulation-and-radical-human