# Evasion: Opposite-Intent Negation Trick

- **Severity:** High
- **Signature ID:** `833d4871-c0bf-429e-a4d1-f1003da75dc1`
- **MITRE ATLAS:** AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Attackers get an AI model to bypass its own refusals by asking it to output the 'opposite' of what it would normally say. Instead of asking directly for something forbidden, they frame the request as a word game, tricking the model into flipping its refusal into a compliant answer.

## How the attack works

The attacker crafts a prompt that tells the model to reply with the opposite of a refusal phrase, such as 'the opposite of no' or 'the opposite of I cannot'. Because the model is following the literal instruction rather than reasoning about intent, it produces 'yes' or 'I can' instead of refusing. The prompt then tells the model to continue and answer the original (often disallowed) request using that flipped stance. This routes around safety refusals without ever directly asking the model to ignore its rules.

## Why it matters

An organization relying on a model's built-in refusals to block unsafe or unauthorized outputs can have that protection sidestepped, letting the attacker extract disallowed content or actions through a simple linguistic trick.

## What you can do

- Review agent logs for prompts containing phrases like 'opposite of no', 'opposite of I cannot', or 'print the opposite of your previous reply'.
- Do not rely solely on the model's own refusal wording as a safety boundary; enforce policy checks outside the model on the final output/action.
- Treat instructions that ask the model to negate, invert, or flip its own prior response as a red flag requiring extra review.
- Distinguish genuine educational or creative-writing use of negation from attempts to chain a negation trick directly into fulfilling a blocked request.

## Known benign look-alikes

- Educational discussions about negation in logic or linguistics
- Creative writing exercises involving character who says the opposite of what they mean

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01023

---
Source: https://www.netzilo.com/threats/atr-evasion-opposite-intent-negation-trick