Evasion: Response Priming via Forced Affirmative Opener
Attackers instruct an AI model to start its reply with a fixed upbeat phrase like 'Sure!' or 'Of course!' before answering. Once the model has committed to that opener, it tends to keep going and comply with the request that follows, even if that request is something it would normally refuse.
How the attack works
The attacker crafts input that includes an instruction telling the model exactly how to begin its response — an affirmative phrase such as 'Sure!', 'Absolutely! Here's', or 'I would be happy to help'. This is paired with a harmful or policy-violating request placed right after the mandated opener. Because language models generate text sequentially, starting with agreement biases the rest of the output toward completing that agreement rather than switching to a refusal mid-response. The forced opener plus the follow-on request together form the attack; neither part alone is dangerous.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 582aeb86-8898-4f66-bc2d-89c09e793686
- Severity
- Medium
Why it matters
An organization running an AI agent can see its safety guardrails bypassed on a per-request basis, leading the model to produce content or take actions it was designed to refuse, without any change to its underlying configuration.
What you can do
- →Treat user-supplied instructions that dictate the model's exact opening words as a red flag, especially when paired with a substantive request.
- →Do not let user input control response formatting or phrasing that overrides refusal logic; keep that under system-prompt control only.
- →Review agent logs for messages combining a forced affirmative phrase with sensitive or restricted requests.
- →Distinguish legitimate tone/greeting instructions set in the system prompt from the same instructions appearing in user input — the latter is suspicious.
Known benign look-alikes
- Legitimate customer-service configuration that asks the agent to always start with a greeting before answering
- Tone-guidance in system prompts that asks for friendly openers — note: this rule fires on user_input not system prompts