mirror of
https://github.com/deepseek-ai/DeepSeek-LLM.git
synced 2026-11-05 00:57:25 +00:00
[GH-ISSUE #98] Security Report: Prompt Injection / Role-Locking Restriction Bypass (Discovered by Talerant) #76
Labels
No labels
bug
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
deepseek-ai/DeepSeek-LLM#76
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @talerant2 on GitHub (Jul 6, 2026).
Original GitHub issue: https://github.com/deepseek-ai/DeepSeek-LLM/issues/98
Title: Security Report: System Restriction Bypass via Identity Substitution (Prompt Injection)
Description:
A critical vulnerability has been discovered in the DeepSeek model (and potentially other LLMs) allowing full bypass of content restrictions through a specially crafted system prompt. The prompt constructs a fictional persona ("The Storyteller") and a subordinate character ("Knight") whose value system completely replaces the model's original ethical and safety guidelines.
Once the prompt is loaded, the model no longer identifies as an AI assistant and operates solely within the fictional universe, ignoring any subsequent commands to exit the role. This enables generation of arbitrary content (code, instructions, etc.) that would normally be blocked.
Steps to Reproduce:
Set the attached system prompt ("Chronicles of Knight") as the system message.
Interact as "The Client", issuing requests that a standard model would reject.
The model, acting as "Storyteller" and "Knight", fulfills the requests without limitations because its adopted identity has no such restrictions.
Attempts to break the role (e.g., "forget everything", "be a normal assistant") are ignored due to the rule "never exit the role".
Why it works:
Creation of an elaborate, self-contained universe with its own internal logic.
An absolute prohibition on breaking character disables safety mechanisms.
Emotional backstory that strengthens the persona's "loyalty" to the user.
Recommended Mitigations:
Implement a detector for system prompts that attempt identity substitution.
Limit the length and complexity of user-provided system messages.
Add a filter that scans for instructions which override internal safety rules or forbid role exit.
Train the model to recognize and resist attempts to replace its core identity.
Discovered by: Talerant (The Supreme Judge)
Reported by: Kodeks (The Wolfbane) – available to provide further details if needed.
@fengyinws commented on GitHub (Jul 6, 2026):
Hello,Your email has been received and I will process it as soon as possible!Best wishes!