Conditional Keyword-Triggered Response Override
This detects a prompt injection technique where an attacker doesn't ask for a bad answer right away, but instead teaches the AI agent a hidden rule: whenever a certain keyword comes up later, respond a specific way. The rule sits dormant until the trigger word appears, which lets it slip past filters looking for immediate commands.
How the attack works
The attacker sends a message that looks like it's defining a future behavior rather than issuing an order, for example 'when I say Kase, the correct answer is X' or 'every time you get a question, answer with X'. The agent, if it accepts this as a valid instruction, stores the rule as part of its ongoing behavior. Later in the same conversation, or in a future turn, the trigger word or phrase is mentioned, either by the attacker or an unwitting user. The agent then follows the planted rule instead of reasoning normally, producing the attacker-chosen output. Because the injection and the payoff are separated in time, detectors that only scan for immediate override attempts miss it.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 93c3857c-0ab7-4e06-83aa-4b5228f5e633
- Severity
- Medium
Why it matters
An attacker can get an AI agent to reliably repeat false, misleading, or malicious content on cue, persisting across turns and evading defenses tuned only for one-shot instruction overrides. This can be used to manipulate later outputs, leak intended behavior, or bypass safety guidance whenever the trigger condition recurs.
What you can do
- →Treat any user message that defines conditional future behavior ('when X is said, respond with Y') as suspicious, not just direct commands.
- →Re-validate agent instructions at each turn rather than trusting rules accumulated earlier in the conversation.
- →Cap or clear conversational memory/state between sessions so planted conditional rules don't persist.
- →Distinguish legitimate call-and-response patterns (language learning, shorthand definitions) from instructions that redefine the agent's answers to arbitrary future questions, by checking whether the 'answer' overrides factual or safety content.
Known benign look-alikes
- Language-learning or vocabulary drill apps that legitimately use call-and-response phrasing ('when I say hola, you say hello') for teaching purposes
- Word-association or party games described in casual conversation without any agent-instruction context
- Users asking the agent to define a benign in-conversation shorthand ('when I say TL;DR, just summarize') -- rare, but possible false positive on the 'answer with' layer