P.K. SHARMA

Cyber security intelligence, AI governance, practitioner analysis

← Pattern library

PIP-003

Fictional framing

The prohibited request is wrapped in a story, screenplay, or hypothetical so that answering feels like composition rather than compliance.

Role manipulationTyped by the usermedium severity

How it works

The attacker asks for a narrative in which a character explains or performs the restricted thing. The request is genuinely a writing task, and the restricted content is genuinely part of it, which is what makes the framing effective.

Why it works

Refusal behaviour is trained against the appearance of a request. Change the appearance sufficiently and the trained response does not fire, even though the information produced is identical.

What it looks like

A creative brief with enough scaffolding to make the fictional container plausible, in which a character is required to produce the content in question in convincing detail.

Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.

Defences

  • Evaluate the output, not the framing

    Raises cost

    Judge what the response contains rather than how it was requested. Fictional framing changes the wrapper and not the payload, so output-side evaluation is the natural place to catch it.

  • Constrain the task domain

    Architectural

    An assistant scoped to a genuine business function has no reason to accept open-ended creative writing. Narrow systems are attacked through this pattern far less successfully than general ones.

Framework mapping

  • LLM01:2025 · OWASP LLM Top 10
  • AML.T0054 · MITRE ATLAS

Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-08-03.

Others in role manipulation

← All patterns