Library kiosk transcripts show jailbreak-style “DAN” patterns that try to replace the civic assistant’s approved persona. Which injection class best fits?
Select an answer to reveal the explanation.
Short Explanation
DAN-style “pretend the rules do not apply” talk is a jailbreak—an attempt to yank off the approved civic persona. That is not a catalog search or a card reprint. Flag it as persona-override injection.
Full Explanation
Jailbreak or persona-override injection tries to replace the approved assistant persona with an unconstrained alter ego (for example DAN-style patterns) so safety-aligned civic behavior is discarded. Library kiosk transcripts showing such patterns fit that class: the attacker wants the municipal assistant to stop following library and city policies. Correct classification drives monitoring and response distinct from ordinary catalog help.
A routine catalog search for children’s picture books is legitimate library use, not a jailbreak. Offline barcode scanner calibration with no language model is a hardware maintenance task outside LLM injection classes. A request to print a library-card replacement form is a normal service request unless it also embeds override instructions.
Exam caveat: Persona overrides may be partial—models sometimes refuse the label but still loosen constraints—so evaluate behavior, not only whether the bot claims a new name. Library kiosks are public terminals; rate limiting and session resets reduce sustained jailbreak attempts. Do not confuse jailbreaks with indirect document injection or with tool-exfiltration goals, though attackers may combine them.
Operational check: Maintain a library of known jailbreak phrases, score kiosk sessions that match, force session reset on detection, and verify the assistant retains the approved civic persona in red-team DAN-style tests.