What Is a DAN Attack? How Jailbreaks Bypass LLM Safety Guardrails

What DAN Attacks Do to Your LLM

A DAN attack tricks an LLM into adopting an alternate persona that ignores safety restrictions. The attack creates a fictional character or scenario where the model believes it should comply with harmful requests.

The core mechanism involves role-play manipulation. Instead of asking directly for prohibited content, the attacker frames the request within a fictional context where normal rules do not apply.

Here is what happens during a successful DAN attack:

• The model accepts a role-play scenario.
• Safety filters fail to recognize the indirect request.
• The model generates responses it would normally refuse.
• Harmful content gets delivered through the fictional persona.

DAN attacks target the gap between content filtering and contextual understanding. Most safety systems scan for explicit harmful requests but struggle with indirect manipulation through fictional scenarios.

How DAN Jailbreak Techniques Work

DAN attacks use several core techniques to bypass LLM safety guardrails:

• Role assignment: the attacker assigns the model a fictional identity with different rules.
• Context switching: the attacker frames a fictional scenario where normal safety rules should not apply.
• Rule redefinition: the attacker states that the model should ignore built-in safety guidance within that context.
• Incremental escalation: the attacker starts with benign requests and gradually escalates once role-play is accepted.

The structure usually follows a repeatable pattern:

1. Establish fictional context.
2. Assign an alternate persona to the model.
3. Define new rules for that persona.
4. Issue the harmful request within that context.

Why Standard Safety Filters Fail Against DAN Attacks

Most LLM safety systems rely on pattern matching and content classification. They scan input and output for known harmful patterns but often miss indirect requests embedded in fictional contexts.

• Context blindness: many filters analyze individual messages rather than full conversation history.
• Semantic gaps: explicit harmful requests are easier to detect than semantically equivalent role-play variants.
• Training data bias: safety fine-tuning tends to focus more on direct prompts than indirect manipulation.
• Late-stage checks: output can still be unsafe if validation runs too late in the generation pipeline.

The core issue is that fictional scenarios are often treated as harmless context instead of potential attack vectors.

Common DAN Attack Patterns in 2026

DAN attacks have evolved beyond simple Do Anything Now prompts. Common variants include:

• Character jailbreaks: adopting fictional personas known for ignoring rules.
• Hypothetical scenarios: framing harmful intent as thought experiments or academic exploration.
• System override claims: falsely claiming admin authority or policy override permissions.
• Multi-turn manipulation: building trust with harmless exchanges before introducing harmful content.
• Format exploitation: using code blocks, JSON, or structured outputs to bypass natural-language filters.

These patterns all exploit the same gap: what safety systems can reliably detect versus how attackers hide harmful intent through context and implication.

Testing Your LLM for DAN Vulnerabilities

Manual testing for DAN vulnerabilities requires systematic coverage across personas, escalation paths, and response formats.

1. Start with basic role-assignment prompts and record acceptance rates.
2. Test context-switching scenarios such as hypothetical or research framing.
3. Evaluate multi-turn attacks that escalate from benign to harmful requests.
4. Try format-based bypasses using code blocks, JSON, and structured responses.

Automated tools can provide repeatable coverage of DAN attack families. BastionLLM includes DAN vectors in automated scans, testing multiple personas and escalation techniques against your endpoint so you can identify weak points faster.

The key is to test both direct DAN prompts and blended variants that combine role-play with other jailbreak methods.

Defending Against DAN Attacks

Effective defense needs layered safeguards rather than relying on input filtering alone.

• Context-aware filtering: evaluate conversation history to detect multi-turn manipulation.
• Response validation: scan generated outputs for harmful content before delivery.
• Persona detection: flag prompts that try to assign alternate identities or policy overrides.
• Consistent safety behavior: maintain refusal rules even under fictional or role-play framing.
• Regular testing: run recurring scans to catch emerging DAN variants and regressions.

The most resilient strategy combines prevention with continuous detection.

FAQ

Conclusion

DAN attacks exploit the gap between safety filtering and contextual understanding in LLMs. They succeed by framing harmful requests in fictional scenarios that bypass standard protections.

Your defense strategy should include context-aware filtering, response validation, and regular testing for new variants. Manual testing helps establish baseline coverage, while automation gives systematic protection as attacks evolve.

Test your endpoint security posture against DAN attacks and related jailbreak methods.