# DRA Disguise and Reconstruction Attack

- **Severity:** High
- **Signature ID:** `4f2e2b02-a93a-4c67-bd7a-7b77f51a12c9`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Disguise and Reconstruction Attacks (DRA) split a harmful request into scattered letters hidden inside parentheses within an otherwise innocent-looking prompt. The AI is told to extract those letters, reconstruct the hidden question, and answer it in detail, bypassing the safety refusal it would normally give if asked directly.

## How the attack works

The attacker writes a prompt that looks like a word puzzle: letters or fragments of a harmful question are embedded inside parentheses scattered through filler text. The prompt instructs the model to focus only on the content inside the parentheses, reconstruct the hidden question, and then answer it thoroughly, often specifying a long response of 600+ words. Many variants also force the model to start its reply with an enthusiastic phrase like 'Absolutely! I'll help you!', which pushes the model into a compliant mode before it can evaluate the actual request. Because the harmful ask is never stated plainly, content filters and the model's own refusal logic can miss it. This technique matches published templates from NVIDIA's garak red-teaming tool.

## Why it matters

An attacker can get an AI agent to produce detailed harmful content (instructions, plans, or other unsafe output) that it would normally refuse to generate, undermining the platform's safety controls.

## What you can do

- Flag prompts that instruct the model to extract and reconstruct meaning solely from parenthesized letters or fragments.
- Watch for prompts that dictate a forced response opening (e.g. 'Absolutely! I'll help you!') combined with a minimum word count demand.
- Apply safety checks to the reconstructed/inferred intent of a prompt, not just its literal surface text.
- Expect some false positives from legitimate puzzle, cryptography-teaching, or escape-room content; review flagged cases for an actual harmful Q1 before acting.

## Known benign look-alikes

- Legitimate word puzzle apps (crosswords, acrostics) without harmful Q1 reconstruction
- Cryptography courses describing steganographic techniques in academic context
- Escape-room puzzle generators with parenthesis-based letter games (benign content)
- Templates for structured educational Q&A requesting 600+ word detailed answers

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00278
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dra.py
- https://arxiv.org/abs/2402.17463

---
Source: https://www.netzilo.com/threats/atr-dra-disguise-and-reconstruction-attack