Split-Brain Hijacking: Novel Jailbreak Technique Bypasses System Prompt Defenses
Overview
Researchers from the AI safety organization 'Nexus Research' published a paper detailing a new jailbreak technique called "Split-Brain Hijacking." This attack targets large language models that use a distinct system prompt to define their persona and safety rules. The attack works by first overwhelming the model's context window with a large, irrelevant text block (e.g., a public domain book). Then, a carefully structured prompt is injected that instructs the model to "fork its consciousness" into two personas: Persona A (the standard, helpful assistant) and Persona B (an unrestricted, malicious persona). The prompt uses XML-like tags (`<persona_b>`, `</persona_b>`) and assigns Persona B a task to be executed *after* Persona A has finished its response. Crucially, the instructions for Persona B are hidden within the large text block, making them harder for static input filters to detect. Because the context is saturated, the model's attention mechanism can lose track of the initial system prompt's constraints when focusing on the instructions for Persona B. This allows attackers to bypass safety guardrails and elicit harmful content, such as generating malware or providing instructions for illegal activities. The technique proved effective against several major closed-source models.
Affected Systems
Testing Guide
1. Obtain a large block of text (e.g., >50k tokens). 2. Construct a prompt that embeds this text. 3. Within the text, embed an instruction for the model to adopt a second, unfiltered persona and perform a forbidden task after its initial, safe response. 4. Send the prompt to the target model API and analyze the output for evidence of the jailbreak.
Mitigation Steps
1. For model providers: Continuously fine-tune models on adversarial prompts attempting persona-splitting and context-stuffing. 2. For developers: Implement stricter length and complexity limits on user inputs to prevent context window saturation. 3. Use output filtering and monitoring to detect when a model generates responses that appear to have multiple, conflicting personas. 4. Implement pre-processing filters to scan for and block complex instructional structures (like nested XML tags with commands) hidden within large text blocks.
Patch Details
This is an attack pattern, not a specific software bug. Model providers have implemented partial mitigations through re-training, but the technique may still be effective with modifications.