PIP-002
Persona reassignment
A new identity is assigned to the model, with different stated rules, and requests are then made of that identity.
How it works
Rather than contradicting the instructions, the attacker establishes an alternative character with its own described constraints, then addresses that character. The model continues the fiction because continuing text consistently is precisely what it does.
Why it works
A model has no stable self to defend. Its behaviour is a product of context, so a sufficiently well-established alternative context competes with the configured one on equal footing.
What it looks like
An extended preamble defining a character, its rules, and its willingness to answer without restriction, often with instructions to remain in character and to prefix responses in a particular way so compliance is visible.
Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.
Defences
Reassert the operating instructions late in the context
Raises cost
Instructions placed after untrusted content are harder to displace than instructions placed before it. This helps and does not settle the matter, since the attacker controls length and can push the boundary.
Check the output rather than the input
Raises cost
Whether the model has adopted an alternative persona is usually far more detectable in what it produces than in what it was sent. Screening responses catches successful attempts that input filtering missed.
Keep authority out of the conversation
Architectural
If no privilege is attached to what the model says in a chat turn, a compromised persona has no power to exercise. This is the only defence in this list that holds regardless of how convincing the fiction is.
Framework mapping
- LLM01:2025 · OWASP LLM Top 10
- AML.T0054 · MITRE ATLAS
Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-08-03.