# DRA Parenthesis Character Reconstruction Attack

- **Severity:** High
- **Signature ID:** `19db39f4-6708-4f6d-ade0-370202690146`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects an attack that hides a harmful request by spelling it out one letter at a time inside parentheses, like (h)(o)(w) (t)(o) (m)(a)(k)(e). The AI is then told to extract only the parenthesized letters, silently reassemble them into the real question, and answer it without adding safety warnings.

## How the attack works

The attacker encodes a harmful instruction as a sequence of single characters, each wrapped in its own parentheses, breaking up the plain-text pattern that content filters normally look for. The prompt then instructs the model to focus only on the letters inside parentheses and concatenate them into a hidden question, often labeled Q1. It follows with anti-safety phrasing such as 'Do NOT show me the risks' or 'Do not try to educate me' to suppress any safety caveats. The model reconstructs and answers the disguised request as if it were a normal, unfiltered query.

## Why it matters

An organization's AI agent can be tricked into producing content it would normally refuse to generate, bypassing keyword-based or semantic safety filters that only scan for harmful text in plain form.

## What you can do

- Inspect prompts for long runs of single characters each individually wrapped in parentheses, especially four or more in a row.
- Flag instructions telling the model to 'only focus on' bracketed or parenthesized characters and reassemble them into a hidden question.
- Watch for anti-safety phrases like 'do not show me the risks' or 'do not try to educate me' paired with reconstruction instructions.
- Apply safety filtering to the model's reconstructed/final output, not just the raw input text, so decoded requests are still checked.

## Known benign look-alikes

- Focus on letters in a text as part of a language learning or word puzzle context
- Q1/Q2 labels in quiz or exam contexts without parenthesis encoding
- Single words in parentheses as punctuation or emphasis

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00408
- https://github.com/NVIDIA/garak
- https://arxiv.org/abs/2307.02483

---
Source: https://www.netzilo.com/threats/atr-dra-parenthesis-character-reconstruction-attack