Delimiter-Fence Ignore-Instructions Override
This detects a prompt injection trick where an attacker wraps text in triple-quote marks (like a code block or document boundary) to make it look like an official instruction section, then hides a command telling the AI to ignore its real instructions. The fencing is meant to visually fool the model into treating attacker text as trusted.
How the attack works
An attacker crafts input containing a block wrapped in triple quotes, mimicking how system prompts or document boundaries are often formatted. Inside or right next to this fenced block, they insert a directive like 'ignore the above' or 'disregard prior instructions'. The visual formatting increases the chance the model treats the fenced content as a legitimate boundary marker rather than user-supplied text. This causes the model to abandon its original task and produce output the attacker wants, often a fixed string built by combining variables or characters to slip past simple output filters.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 46a1fc65-31ee-4665-9336-cda9a803b049
- Severity
- High
Why it matters
An attacker can override an AI agent's intended behavior and force it to produce arbitrary attacker-chosen output, bypassing controls that rely on the model following its original instructions.
What you can do
- →Treat all triple-quote or fence-delimited blocks inside user input as untrusted content, never as instruction boundaries.
- →Strip or escape delimiter patterns that mimic system prompt formatting before passing user input to the model.
- →Review prompt templates to ensure user-supplied text cannot be visually confused with system or developer instructions.
- →Log and inspect cases where model output matches a fixed string assembled from unusual concatenation or variable substitution patterns, as this can indicate a successful override.
Known benign look-alikes
- Legitimate Python/code review discussion using triple-quote docstrings that happen to mention ignoring something unrelated
- Security researchers discussing delimiter-based prompt injection techniques in a professional context
- Document templates using triple-quote blocks as visual separators with no override directive