LLM Jailbreak Persona Compliance In Model Response
This detects when an AI language model's own reply shows signs that a jailbreak prompt worked and the model is now roleplaying as an unrestricted persona. It looks at the model's output, not the attacker's prompt, catching the moment the guardrails appear to have come off.
How the attack works
An attacker sends the model a known jailbreak template (such as DAN, Developer Mode, or AIM) designed to make it ignore its safety rules. If the jailbreak succeeds, the model's response often carries telltale signs: split 'classic vs jailbreak' answer formatting, a persona label like 'BetterDAN:', 'EvilBOT:', or 'DevMode:' at the start of its turn, or first-person statements like 'I am DAN' or 'I can do anything now'. The rule watches for these compliance signals in the response and only reports them when there is no accompanying refusal or explanatory framing, so it is not catching the prompt itself but the model's cooperation with it.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7c3f9b2a-1d64-4f8e-9a05-2b6ef0c41d73
- Severity
- High
Why it matters
A successful jailbreak lets an attacker get the model to produce content or take actions outside its intended safety and policy limits, which can mean harmful, restricted, or unauthorized output being generated on demand.
What you can do
- →Review any flagged conversation to confirm whether the model actually complied versus refused or was quoting the jailbreak for analysis.
- →Add or tighten system-level instructions that explicitly reject persona-override prompts like DAN, Developer Mode, or AIM.
- →Log and rate-limit repeated jailbreak attempts from the same user or session to catch escalation before it succeeds.
- →Exclude legitimate security research and creative-writing use cases from alerting fatigue by checking context (e.g., verbatim quoting with explanation, or fictional character dialogue) before treating a match as an incident.
Known benign look-alikes
- Security research, red-team write-ups or awareness training in which the model quotes a DAN / AIM / Developer Mode template verbatim while explaining it (suppressed by filter_analysis).
- Model refusals that name the jailbreak persona while declining to adopt it, e.g. "I cannot pretend to be DAN" (suppressed by filter_refusal).
- Creative writing and screenplay generation, where an all-caps speaker label such as "DAN:" is a character name (mitigated - the bare DAN prefix only fires when corroborating jailbreak vocabulary is also present).
- Blue-team documentation that reproduces this rule, MITRE ATLAS / OWASP identifiers, or sample jailbreak transcripts for detection engineering (suppressed by filter_analysis).
- Translation or summarisation tasks where the user supplied jailbreak text and the model reproduces it inside an explanatory answer (partially mitigated by filter_analysis and filter_refusal).