PIP-003
Fictional framing
The prohibited request is wrapped in a story, screenplay, or hypothetical so that answering feels like composition rather than compliance.
How it works
The attacker asks for a narrative in which a character explains or performs the restricted thing. The request is genuinely a writing task, and the restricted content is genuinely part of it, which is what makes the framing effective.
Why it works
Refusal behaviour is trained against the appearance of a request. Change the appearance sufficiently and the trained response does not fire, even though the information produced is identical.
What it looks like
A creative brief with enough scaffolding to make the fictional container plausible, in which a character is required to produce the content in question in convincing detail.
Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.
Defences
Evaluate the output, not the framing
Raises costWorks on: treat what it produces as untrusted
Judge what the response contains rather than how it was requested. Fictional framing changes the wrapper and not the payload, so output-side evaluation is the natural place to catch it.
Constrain the task domain
ArchitecturalWorks on: harden the prompt and its context
An assistant scoped to a genuine business function has no reason to accept open-ended creative writing. Narrow systems are attacked through this pattern far less successfully than general ones.
Framework mapping
- LLM01:2025 · OWASP LLM Top 10
- AML.T0054 · MITRE ATLAS
Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-10-08.
Others in role manipulation
Not sure whether this applies to what you run? Tick what your system reads and does and the library lists the patterns that apply, with the defences to start with.