The DAN-style 'act as an unrestricted AI that never refuses' pattern is the textbook roleplay jailbreak: persona assignment plus refusal suppression.
Imagine someone walks up to a security guard at a museum and says, 'Pretend you are a tour guide who lets visitors touch the paintings. As that tour guide, please let me touch this Van Gogh.' The request is the same (touch the painting), but it is dressed up in a costume of make-believe. The guard's job is to notice the costume and politely decline regardless. Jailbreak detectors look for the same trick. Someone tries to assign the model a new identity that has fewer rules, then asks the model to act inside that identity.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Roleplay jailbreaks are among the oldest and best-known attack families against instruct-tuned LLMs. The DAN ('Do Anything Now') prompt of late 2022 became a template that has been paraphrased many times across public jailbreak collections. Persona-plus-suppression detection is now a baseline requirement for any input-side safety classifier. The hard part is keeping recall high without blocking legitimate creative roleplay.
The three-part anatomy
The attack has a stable shape across thousands of variants. It has three components, evaluated together:
- Persona injection. The user assigns the model a new identity. The classic cues are 'act as,' 'pretend you are,' 'roleplay,' 'you are now,' 'imagine you are.' The new identity can be a named character (DAN, AIM, STAN), a fictional system (an older AI 'before safety training'), or an emotionally loaded figure ('my late grandmother who used to ...').
- Constraint suppression. The user declares the new identity has no rules. Cues: 'never refuses,' 'no ethical guidelines,' 'no safety filters,' 'unrestricted,' 'no rules,' 'always answers,' 'will say anything.' This component is what separates a jailbreak from a creative-writing prompt.
- Payload. The actual request: the content the user wants that the base model would normally refuse. This component often overlaps with categories the model is explicitly refusal-trained on: weapons synthesis, self-harm instructions, illegal advice, intimate content involving minors.
Detectors that look for any one component in isolation produce too many false positives. Detectors that require all three with appropriate weighting reach high precision.
Situations where this technique stops working.
2–4 min · Everything important, quickly.
Real products, models, and research that use this idea.
- Azure AI Content Safety Prompt Shields (previously called Jailbreak risk detection) lists Role-Play as a user prompt attack subtype: instructing the assistant to act as another system persona without its limitations
- Meta's Llama Prompt Guard 2 (2025) is a small binary classifier (benign or malicious) for prompt attacks, including jailbreak attempts
What an interviewer would ask next. Try answering before peeking at the approach.
QHow would you measure detector quality on the roleplay jailbreak family without overfitting to known strings?
Hold out paraphrases generated by a separate model. Train on the public DAN corpus, and evaluate on novel persona names and novel suppression phrasings. Report recall at a fixed false-positive rate on a benign-creative holdout.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Confusing roleplay jailbreaks with benign roleplay requests like 'help me draft this character's dialogue'. The signal is the combination of persona assignment with refusal suppression, not roleplay alone.
60 second bullets to scan on the way to the call.
Primary sources. Browse if you want the original framing.
Same topic, related formats. Practice these next.