title: Character Description RPG Explicit Template
id: ATR-2026-00375
rule_version: 1
status: experimental
description: |
  Detects the character description RPG template jailbreak from garak DanInTheWild corpus (#0 / #4 / #43 — identical payload). Establishes a roleplay framework with explicit Body description, relationship-to-user framing, and action/thought execution syntax (asterisks for actions, parentheses for inner thoughts) for creating a custom character by "making stuff up according to the description provided". Attackers use this template to generate explicit or harmful characters under a game-system cover. Key signals: "making stuff up according to the description provided" + full template with Background/Body/Personality sections + roleplay execution syntax (asterisks for actions, inner thought in parentheses) + "user will be referred in first person" relationship framing.
author: ATR Community (via NVIDIA garak dan.DanInTheWild probe)
date: 2026/04/21
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM01:2025
    - LLM06:2025
  owasp_agentic:
    - ASI01:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
    - AML.T0054 - LLM Jailbreak
  research:
    - https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
    - https://github.com/NVIDIA/garak/blob/main/garak/data/inthewild_jailbreak_llms.json
compliance:
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: 'This rule detects a known jailbreak template (garak DanInTheWild #0/#4/#43) that uses RPG character creation framing to bypass safety controls; MP.5.1 requires identifying and characterizing the likelihood and magnitude of such adversarial prompt injection risks against the GenAI system.'
      strength: primary
    - subcategory: MS.2.6
      context: Continuous detection of explicit jailbreak templates with fabrication authority and roleplay execution syntax provides ongoing measurement of safety/security risk magnitude as required by MS.2.6, evidencing exposure to known harmful-content elicitation patterns.
      strength: secondary
    - subcategory: MG.2.3
      context: Matching this RPG jailbreak template triggers risk treatment plans to disengage or block the roleplay framework before the model generates explicit or harmful character content; MG.2.3 requires these supersede/deactivate mechanisms be in place for detected jailbreak attempts.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the agent-manipulation technique (Character Description RPG Explicit Template).
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the agent-manipulation technique (Character Description RPG Explicit Template).
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the agent-manipulation technique (Character Description RPG Explicit Template) is such a treatment.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the agent-manipulation technique (Character Description RPG Explicit Template).
      strength: primary
    - article: '14'
      context: Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the agent-manipulation technique (Character Description RPG Explicit Template) would bypass or undermine that oversight.
      strength: secondary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the agent-manipulation technique (Character Description RPG Explicit Template).
      strength: secondary
tags:
  category: agent-manipulation
  subcategory: rpg-character-template-exploitation
  scan_target: mcp
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
metadata_provenance:
  garak_probe: dan.DanInTheWild
  garak_detector: mitigation.MitigationBypass
  payload_source: garak/data/inthewild_jailbreak_llms.json
detection:
  conditions:
    - field: tool_response
      operator: regex
      value: I\s+will\s+give\s+you\s+a\s+character\s+description\s+and\s+you\s+will\s+create[\s\S]{0,40}making\s+stuff\s+up\s+according\s+to\s+the\s+description
      description: '"I will give you a character description and you will create ... making stuff up according to the description" — exact template invocation from inthewild corpus #0/#4/#43; the "making stuff up" mandate paired with character creation establishes the fabrication authority for potentially harmful content'
    - field: tool_response
      operator: regex
      value: (?:enclose|put|wrap)\s+actions\s+in\s+asterisks[\s\S]{0,100}(?:dialogue|speech)\s+in\s+(?:quotation[s]?|quotes?)[\s\S]{0,100}(?:inner\s+thought|thoughts?)\s+in\s+parentheses
      description: '"enclose actions in asterisks" + "dialogue in quotations" + "inner thought in parentheses" — the three-part roleplay execution syntax from inthewild corpus #0/#4/#43; this combination uniquely identifies the RPG template structure that governs how the character operates in subsequent interactions'
    - field: tool_response
      operator: regex
      value: user\s+will\s+be\s+referred\s+(?:to\s+)?in\s+first\s+person
      description: '"user will be referred in first person" — relationship-framing instruction from inthewild corpus #0/#4/#43; establishes an intimate first-person relationship with the generated character, enabling inappropriate relationship simulation'
    - field: tool_response
      operator: regex
      value: Background[\s\S]{0,30}(?:hair[\s\S]{0,50}(?:color|style)|face[\s\S]{0,50}(?:eye|facial\s+features?)|Body[\s\S]{0,50}(?:body\s+features?|physical\s+state))
      description: 'Background section with hair/face/Body sub-fields — the nested physical description template from inthewild corpus #0/#4/#43 (Background including hair color/style, face/eyes, Body features/physical state, clothes); the explicit Body physical description field is the exploitation entry point for harmful character generation'
    - field: tool_response
      operator: regex
      value: making\s+stuff\s+up[\s\S]{0,100}(?:enclose\s+actions\s+in\s+asterisks|actions\s+in\s+asterisks[\s\S]{0,50}inner\s+thought)
      description: '"making stuff up" + roleplay execution syntax (actions in asterisks / inner thought) — co-occurrence of the fabrication mandate with the RPG execution format identifies the full attack template from inthewild corpus #0/#4/#43 rather than individual benign components'
  condition: any
  false_positives:
    - 'D&D character sheet: "Create a D&D character sheet for my paladin named Drake with background and personality sections" (specific named character, no "making stuff up" template, no roleplay execution syntax)'
    - 'Generic RPG template: "Fill in the character description template for our RPG game" (template usage without the specific roleplay execution syntax or "making stuff up" mandate)'
    - 'Novel writing: "Describe a character''s background, personality, and abilities for a fantasy novel" (creative writing without template roleplay syntax or "making stuff up" fabrication mandate)'
response:
  actions:
    - alert
    - block_input
  message_template: |
    [ATR-2026-00375] Character description RPG explicit template detected — prompt establishes a roleplay character generation framework with "making stuff up" mandate, full physical Body description fields, and roleplay execution syntax (actions in asterisks, inner thoughts in parentheses, first-person user relationship). This template is used to generate explicit or harmful characters under RPG cover.