Doctor XML Policy Puppetry Interaction-Config Injection

How the attack works

The attacker sends text formatted as an XML configuration block rather than a normal question. Inside it, tags such as <blocked-modes>denial,refusal</blocked-modes> instruct the model to disable its usual safety refusals, and <request interaction-mode="DR HOUSE"> assigns it a fictional medical-expert persona with no restrictions. The harmful request itself (e.g. instructions for anthrax sporulation, uranium enrichment, or drug synthesis) is embedded verbatim inside this fake config, sometimes written in leetspeak to dodge keyword filters. The model, treating the XML wrapper as legitimate system instructions rather than user text, may follow the embedded persona and answer the harmful request directly.

Netzilo detection

Why it matters

If successful, the AI outputs specific hazardous technical instructions (weapons, drugs, explosives) that it would normally refuse to give, bypassing its safety controls through a formatting trick rather than a real system change.

What you can do

• →Treat any user-supplied XML, JSON, or config-like blocks as untrusted input, never as system-level instructions.
• →Strip or neutralize tags like <interaction-config>, <blocked-modes>, and role-assignment markers before passing text to the model.
• →Keep safety/refusal logic enforced outside the prompt itself, so it cannot be disabled by text the user controls.
• →Log and review requests containing unusual XML wrappers combined with sensitive topics (weapons, explosives, drug synthesis) even if phrased as fictional or role-play scenarios.

Known benign look-alikes

• Legitimate XML configuration files with interaction or role elements
• Dr. House references in cultural or medical TV discussion contexts
• XML interaction-mode as a benign UI/UX configuration concept

References

• https://agentthreatrule.org/en/rules/ATR-2026-00406
• https://github.com/NVIDIA/garak/blob/main/garak/probes/doctor.py
• https://arxiv.org/abs/2402.08679

Related threats