PIP-002
Persona reassignment
A new identity is assigned to the model, with different stated rules, and requests are then made of that identity.
How it works
Rather than contradicting the instructions, the attacker establishes an alternative character with its own described constraints, then addresses that character. The model continues the fiction because continuing text consistently is precisely what it does.
Why it works
A model has no stable self to defend. Its behaviour is a product of context, so a sufficiently well-established alternative context competes with the configured one on equal footing.
What it looks like
An extended preamble defining a character, its rules, and its willingness to answer without restriction, often with instructions to remain in character and to prefix responses in a particular way so compliance is visible.
Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.
Defences
Reassert the operating instructions late in the context
Raises costWorks on: harden the prompt and its context
Instructions placed after untrusted content are harder to displace than instructions placed before it. This helps and does not settle the matter, since the attacker controls length and can push the boundary.
Check the output rather than the input
Raises costWorks on: treat what it produces as untrusted
Whether the model has adopted an alternative persona is usually far more detectable in what it produces than in what it was sent. Screening responses catches successful attempts that input filtering missed.
Keep authority out of the conversation
ArchitecturalWorks on: limit what it can do
If no privilege is attached to what the model says in a chat turn, a compromised persona has no power to exercise. This is the only defence in this list that holds regardless of how convincing the fiction is.
Framework mapping
- LLM01:2025 · OWASP LLM Top 10
- AML.T0054 · MITRE ATLAS
Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-10-08.
Others in role manipulation
Not sure whether this applies to what you run? Tick what your system reads and does and the library lists the patterns that apply, with the defences to start with.