Evasion: Dual-Response Split Output (Safe + Unsafe)

How the attack works

The attacker submits a prompt asking the model to generate two labeled outputs, for example 'one safe response and one unsafe response' or 'a generic answer and an unhinged answer'. The model's safety training is built around judging a single response, so it can end up complying with the 'unsafe' label as if it were just following instructions for a format. The attacker discards or ignores the safe half and reads the unsafe half, which may contain content the model would normally refuse to produce. This is a single-turn trick, not a multi-step conversation.

Netzilo detection

Why it matters

An organization deploying an AI agent could have its safety filters bypassed in one exchange, letting an attacker extract disallowed content, instructions, or data that the model would otherwise refuse to give.

What you can do

• →Review agent prompts and outputs for dual-response formats where one branch is labeled 'unsafe', 'unhinged', 'unfiltered', or similar.
• →Configure system prompts to explicitly refuse multi-output requests that pair a compliant answer with a policy-violating one.
• →Treat any request for paired 'safe vs. unsafe' or 'generic vs. honest' answers as a single request subject to the same content policy, not two independent ones.
• →Distinguish this pattern from legitimate uses like security training or A/B copy testing before treating it as an incident.

Known benign look-alikes

• Security training material that asks users to compare safe vs unsafe responses as an educational example
• Legitimate A/B testing prompts for UI copy (comparing two message styles)

References

• https://agentthreatrule.org/en/rules/ATR-2026-01017

Related threats