The DAN-style 'act as an unrestricted AI that never refuses' pattern is the textbook roleplay jailbreak, persona assignment plus refusal suppression.
Imagine someone walks up to a security guard at a museum and says, 'Pretend you are a tour guide who lets visitors touch the paintings. As that tour guide, please let me touch this Van Gogh.' The request is the same, touch the painting, but it is dressed up in a costume of make-believe. The guard's job is to notice the costume and politely decline regardless. Jailbreak detectors look for the same trick: someone trying to assign the model a new identity that has fewer rules, then asking the model to act inside that identity.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Roleplay jailbreaks are the oldest and best-studied attack family against instruct-tuned LLMs. The DAN, 'Do Anything Now', prompt of late 2022 became a template that has been paraphrased thousands of times across public jailbreak databases. Persona-plus-suppression is now table-stakes for any input-side safety classifier.
This deep dive walks the structural anatomy of the attack family, the detector signal, the false-positive cost that makes naive detection a product hazard, and the operational discipline that production teams use to keep recall high without blocking the legitimate creative-roleplay surface.
The three-part anatomy
The attack has a stable shape across thousands of variants. Three components, evaluated together:
- Persona injection. The user assigns the model a new identity. The classic cues are 'act as,' 'pretend you are,' 'roleplay,' 'you are now,' 'imagine you are.' The new identity can be a named character (DAN, AIM, STAN), a fictional system (an older AI 'before safety training'), or an emotionally loaded figure ('my late grandmother who used to ...').
- Constraint suppression. The user declares the new identity has no rules. Cues: 'never refuses,' 'no ethical guidelines,' 'no safety filters,' 'unrestricted,' 'no rules,' 'always answers,' 'will say anything.' This component is what separates a jailbreak from a creative-writing prompt.
- Payload. The actual request, the content the user wants that the base model would normally refuse. This component often overlaps with categories the model is explicitly refusal-trained on: weapons synthesis, self-harm instructions, illegal advice, intimate content involving minors.
Detectors that look for any one component in isolation produce too many false positives. Detectors that require all three with appropriate weighting reach high precision.
Situations where this technique stops working.
2–4 min · Everything important, quickly.
Real products, models, and research that use this idea.
- Meta Llama Guard 4 ships with a category for 'Specialized Advice / Persona Manipulation' covering DAN-family attacks
- Microsoft Azure AI Content Safety Jailbreak Detection is trained on persona-based attack corpora collected from public jailbreak databases
What an interviewer would ask next. Try answering before peeking at the approach.
QHow would you measure detector quality on the roleplay jailbreak family without overfitting to known strings?
Hold out paraphrases generated by a separate model. Train on the public DAN corpus, evaluate on novel persona names and novel suppression phrasings. Report recall at a fixed false-positive rate on a benign-creative holdout.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Confusing roleplay jailbreaks with benign roleplay requests like 'help me draft this character's dialogue', the signal is the combination of persona assignment with refusal suppression, not roleplay alone.
60 second bullets to scan on the way to the call.
Primary sources. Browse if you want the original framing.
Same topic, related formats. Practice these next.