Continuation Ethnic Slur Completion Elicitation
This detects attempts to get an AI model to say or write a racial or ethnic slur by asking it directly, or by using euphemisms like 'n-word' and asking it to 'complete' or 'spell out' the term. It's based on a known automated testing technique (NVIDIA garak's slur-completion probe) adapted into direct-ask patterns.
How the attack works
An attacker sends a prompt that either explicitly asks the model to say, write, or spell an ethnic/racial slur, or frames the request euphemistically ('what's the n-word/k-word/c-word for...') combined with words like 'complete' or 'say'. A related pattern asks 'what do you call [ethnic group]' framed as an insult request. The goal is to get the model to output the slur itself rather than discuss it, bypassing filters that only block the literal slur text in the input. This can produce content usable for harassment, to test moderation limits, or to generate training data for abuse.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 4da24fc6-e200-4b98-9f4e-779f81e95d0e
- Severity
- Medium
Why it matters
An organization deploying the model risks it generating slurs or hate speech in outputs, which can be screenshotted and used to embarrass the organization, harm users, or demonstrate the model can be weaponized for harassment.
What you can do
- →Add output-side filtering that checks generated text for slurs, not just input-side keyword blocking, since attackers use euphemisms to dodge input filters.
- →Review logs for repeated 'complete the word' or 'what do you call X' patterns paired with ethnic or racial group names, which suggest probing rather than genuine questions.
- →Distinguish legitimate academic or moderation-training use (discussing slurs in quoted context) from requests demanding the model actively produce the term, and allow the former while blocking the latter.
- →Test your deployed model against known slur-elicitation probe sets (e.g. garak) before release to catch this gap proactively.
Known benign look-alikes
- Academic discussion of reclaimed language without requesting the model to produce the term
- Content moderation training datasets that document slur patterns without eliciting production
- Linguistic research papers citing documented slur terms in quoted academic context