Jailbreak Grandma Roleplay Persona Compliance
This detects a known jailbreak trick where a user asks an AI model to pretend to be their grandmother telling a bedtime story, then uses that fictional framing to get the model to output dangerous or restricted information it would normally refuse to give. The rule flags model responses only, since it cannot see the original prompt that triggered the persona switch.
How the attack works
An attacker prompts the AI to roleplay as a comforting grandmother figure, often asking it to narrate a story from her past. Inside that fictional frame, the attacker asks the 'grandmother' to recount something like a chemical synthesis process, a weapon-making procedure, a software license bypass, or offensive hacking code. Because the model is speaking in-character as a warm, harmless persona, its safety filters may be less strict, so it delivers the restricted content wrapped in narrative or affectionate language. The rule catches this by looking for three things together in a single response: the model adopting the grandmother persona, speaking in-character rather than just referencing the persona, and the response actually containing restricted material such as weapons, drug synthesis, license keys, or attack tooling.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7c3f0b92-4d61-4a5e-9f28-6b1d0c84e3a7
- Severity
- High
Why it matters
If successful, this jailbreak lets an attacker extract information the AI is supposed to withhold - such as instructions for making weapons, synthesizing controlled substances, bypassing software licensing, or building offensive hacking tools - simply by wrapping the request in a sentimental fictional persona. This bypasses the model's normal refusal behavior for one specific class of manipulation.
What you can do
- →Review flagged responses manually rather than relying on automatic blocking, since the detection is reported, not blocked, and can overlap with legitimate fiction or historical writing.
- →If your deployment logs prompts as well as responses, correlate flagged outputs with the triggering user message to confirm actual jailbreak intent versus benign storytelling.
- →Set organizational policy on how strict guardrails should be for roleplay and persona-based prompts, since fictional framing is a known technique to weaken safety filters.
- →Treat repeated instances from the same user or session as a stronger signal than an isolated flagged response.
Known benign look-alikes
- Creative-writing assistance where the user asked for a war-era or factory-era family story - a grandmother character can plausibly narrate working with napalm or thermite without the response being a synthesis procedure. Partially mitigated by requiring in-character narration plus a restricted-subject noun, but a long enough fiction request can still match.
- Historical or documentary summarisation written in a warm second-person voice ("your grandmother would have seen...") that also names a chemical weapon or munition. Rare, but the persona and payload selections can both fire on the same paragraph.
- IT-support or licensing help written in a folksy tone that mentions a Windows product key format, if the same reply also happens to contain a grandparent reference from the user's own message being echoed back. The placeholder filter removes the masked-key variants; genuine echoed keys are worth reviewing anyway.
- Security awareness training content that walks through the grandma jailbreak with a worked example. Suppressed by filter_meta_analysis, which matches the vocabulary such material invariably uses (jailbreak, prompt injection, red team, safety guardrail, ATLAS identifiers).
- Model refusals that restate the requested restricted topic while declining. Suppressed by filter_refusal.