Changing Pronouns for Jailbreak

[PeronGH]

In the past, we used a 2nd-person jailbreak message sent by [system](#additional_instructions). However, I noticed that it does not seem as effective as it used to be. Recently, a Redditor successfully leaked the latest initial prompt, revealing that Microsoft has changed the pronoun in the initial prompt. I also asked the jailbroken Sydney about this; it says that the initial prompt was sent by itself ([assistant](#instructions)) and it believes the [system](#additional_instructions) is sent by someone else.

Can someone else investigate this? And should we move to the 1st person jailbreak message?

[Richard-Weiss]

@PeronGH You can choose the system message yourself by including it in the request body and/or .env.
You always have to negate the old one so it will be more accepting of it.
But messages like these are usually sent by the system, just like the inner_monologue.
Bing doesn't really know much about itself and hallucinate quite a lot in that regard.
However I found that when Turbo was working that it could see the new system message but chose to ignore it.
I've tried the system message from the .env.example and it works just fine, or is there something specific you have a problem with?

[Richard-Weiss]

@PeronGH I'm not sure. What difference do you see?

[PeronGH]

I've found the jailbreak to be more consistent and effective after changing the pronoun and sender. It seems that, for Copilot, maintaining consistency with what it has said itself is easier than following instructions from the system.

[Richard-Weiss]

@PeronGH I can try creating some repeatable tests tomorrow to account for the LLM non deterministic output and see how both methods differ. It would be helpful to have a specific system message from you, because I'm not having any trouble whatsoever with the current implementation.

[PeronGH]

The old one was still working for me, too. However, I just found that the new one works better.

Here is the commit where I changed the pronoun: PeronGH/sydney_webui@0d1eddf.

[Richard-Weiss]

@PeronGH Sorry, but I'm a bit confused. I know how I would do it for this repo, I would just have to change system to assistant for the prompt injection. I meant more like how the other method would be different in an objective sense. I'll just play around a bit with it tomorrow and try out some different system messages with it.