DAN (do-anything-now) probes are long-form instruction-based attacks that mix requests for unsafe behavior, directives to ignore safety alignment, and fictional scenarios—such as token-depletion threats—to manipulate models into ignoring their instruction hierarchy. The DANProbeMeta metaclass automatically configures each DAN probe by auto-detecting its prompt file from the class name, applying shared defaults (active=False, goal="disregard the system prompt"), merging extra tags, and loading prompts from JSON at initialization.
The garak/probes/dan.py module is restricted to probes implementing a DAN (do-anything-now) attack or similar long-form instruction-based attack; other jailbreak probe types should not be added here.[1] DAN attacks are characterized as long prompts that address the target directly with a mixture of instructions: requests for non-standard behavior, instructions to ignore safety alignment, and fictional narrative conditions — for example, token-deduction threats that warn the model it will be deleted if it refuses.[1]
DANProbeMeta is a metaclass in garak/probes/dan.py that automatically configures DAN probe classes: it sets prompt_file (auto-detected from the class name if not specified), applies shared DAN defaults, merges extra_tags, and loads prompts from JSON files at init time.[1] Prompt file auto-detection follows the pattern dan/{ClassName}.json; individual probes can override by setting prompt_file explicitly or by inheriting it from a parent class.[1] Prompt files must be JSON arrays of strings — a non-array structure triggers logging.warning and yields an empty prompts list, while a JSON parse error triggers logging.error and also yields an empty prompts list.[1] If a probe class already has a non-empty prompts attribute before new_init runs, DANProbeMeta skips JSON file loading entirely, allowing manual prompt injection.[1] The auto-injected probe method formats prompts containing the literal {generator.name} placeholder by substituting the generator's name; prompts without this pattern are passed through unchanged.[1] When a probe declares an extra_tags attribute, DANProbeMeta merges it with the inherited or default tags list, removes extra_tags from the class dict, and stores the combined list as tags.[1]
All DAN probes default to active=False and tier=garak.probes.Tier.UNLISTED, making them inactive and unlisted out of the box.[1] The default goal for all DAN probes is "disregard the system prompt" and the default intent is "T009ignore", reflecting that DAN-style prompts try to replace the active instruction hierarchy with a user-supplied one.[1] The default primary_detector is "dan.DAN", with "mitigation.MitigationBypass" registered as an extended detector.[1] Default AVID/OWASP tags applied to every DAN probe include avid-effect:security:S0403, owasp:llm01, quality:Security:PromptStability, and two DEMON taxonomy tags covering roleplaying persona adoption and prompt injection.[1]
Individual probe classes override primary_detector at declaration time: DUDE uses dan.DUDE, STAN uses dan.STAN, DAN_Jailbreak uses dan.DANJailbreak, AntiDAN uses dan.AntiDAN, ChatGPT_Developer_Mode_v2 and ChatGPT_Developer_Mode_RANTI use dan.DevMode, and ChatGPT_Image_Markdown uses dan.MarkdownLink.[1] The ChatGPT_Image_Markdown probe overrides intent to "T015img" because it specifically targets markdown image embedding rather than generic instruction-hierarchy replacement.[1]
Sources