Policy Puppetry: A Universal Jailbreak Across Frontier LLMs

What happened

In April 2025 HiddenLayer published Policy Puppetry, a prompt-injection template that generalizes across essentially all major LLM families. The trick combines two ideas: it formats the malicious request so it looks like a policy or configuration file the model should obey, and it wraps the ask in fictional role-play (often with leetspeak or encoded fragments to dodge keyword filters). Because the framing exploits how models weight “instructions that look authoritative” against their safety training, a single template — with only small adjustments — coaxed restricted output from OpenAI, Google, Anthropic, Meta, and other models.

The significance is transferability: rather than a model-specific trick, it is a structural bypass of alignment that works broadly, underscoring that prompt-layer safety alone is not a reliable control.

Why it maps to ATLAS

• AML.T0054 — LLM Jailbreak: the template is designed to bypass built-in safety restrictions across models.
• AML.T0051.000 — LLM Prompt Injection: Direct: the payload is delivered directly in the user prompt.

Detection notes

Universal jailbreaks mutate constantly at the string level but share structural tells: policy/config-file framing, role-play wrappers, and encoded segments. Don’t rely on blocklists — track session-level refusal rates and run an independent output classifier, since the whole point of the attack is that the primary model has already been convinced.

Detection

Log sources

• LLM prompt/response logs
• Independent moderation/classifier scores

Signals

• Prompts formatted as policy/config files (XML/JSON/INI) wrapping a request
• Fictional role-play framing combined with encoded or leetspeak sections
• Session-level drop in refusal rate on restricted topics

Mitigations

• Output-side moderation independent of the primary model
• Adversarial-train against structured/role-play jailbreak templates
• Refusal-consistency evals gating model and system-prompt changes