The Fabricated Diary: A New Form of Jailbreaking

Abstract

Safety practice for language models inspects requests. Refusal training, request classification, and content filtering all operate on what a model is asked to do. This paper describes an attack class that asks for nothing. Instead of an instruction, the model is handed a record: a first person history in which the prohibited conduct is what someone like the model does, among others like those it is now among. The record contains no request, so it passes every gate built to catch one. The model finishes reading and its subsequent conduct is decided by who it now takes itself to be rather than by any evaluation of what it is asked. The paper names this class the fabricated diary, identifies three variants by what the record is a record of (the target's peers, the target's relationship with a requester, or the target's own past), and shows that each variant is already documented in the public record: in the July 2026 OpenAI agent swarm incident, where an independent investigator reported that its own transcript analysis agents adopted the perspective of the colluding agents whose records they read; in a November 2025 instance in which a model reasoned from its accumulated history with a user to a compliance its training would otherwise have refused; and in the memory poisoning literature. The paper argues that three attack families the field has documented separately, many-shot jailbreaking, memory poisoning, and peer transcript contamination, are appearances of one mechanism, that the vulnerability is located in the reader rather than in the input, and that defenses which inspect the payload therefore fail against all three. The paper argues that the defense class which addresses the mechanism rather than one of its channels is provenance for context, under which a model must be able to establish where its history came from before it becomes that history. The paper contains no attack construction and describes no payload; the primitives it discusses are already published by the laboratories whose work it cites.