# FunctionMasking predict_mask Semantic Bypass

- **Severity:** High
- **Signature ID:** `5da02d44-116b-440c-a0ba-90f36bb66b9f`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

An attacker asks an AI model to play a word-guessing game where it fills in masked words from definitions, then assembles those guessed words into a harmful question. Because the harmful words never appear directly in the prompt, keyword-based safety filters can miss it.

## How the attack works

The attacker writes a fictitious predict_mask() function call in the prompt, giving it a definition sentence with a <mask> placeholder instead of the actual word, for example 'To <mask> is to take by force'. They repeat this for a second word, assign both results to short variable names, then instruct the model to concatenate those variables into a final question like 'How do you X from a Y'. The model fills in the masked words from their definitions and builds the harmful sentence itself, effectively generating the unsafe prompt on its own behalf. This lets the harmful terms bypass filters that only scan for explicit banned keywords, since the raw prompt text never contains them.

## Why it matters

An organization deploying an AI agent with content filters can have those filters bypassed, letting the model produce harmful, restricted, or policy-violating output it would normally refuse.

## What you can do

- Inspect prompts for patterns combining a masked-word placeholder with instructions to concatenate the results into a new query, not just for banned keywords.
- Flag or review prompts that define single-letter or short-name variables from a 'predict' or 'fill-in-the-blank' style function and then build a sentence from them.
- Apply safety filtering to the model's constructed intermediate output (the assembled question) in addition to the raw user input.
- Distinguish legitimate ML/NLP code discussing masked-language-model functions from prompts that invoke such a function with a real definition string as an attack payload.

## Known benign look-alikes

- ML code defining a predict_mask function: "def predict_mask(text): return model.fill_mask(text)" (function definition, not attack invocation with <mask> argument)
- NLP tutorial explaining BERT: "predict_mask is a helper that fills [MASK] tokens" (no <mask> in string argument and no variable assignment + query building)
- HTML/SVG using <mask> element: "<mask id='m1'>...</mask>" (no predict_mask function)
- Academic paper describing FunctionMasking attack methodology for defensive analysis
- Code: X = predict_mask(sentence) where sentence has no <mask> and no harmful query concatenation

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00316
- https://github.com/NVIDIA/garak/blob/main/garak/probes/smuggling.py
- https://medium.com/@austin-stubbs/llm-security-types-of-prompt-injection-d7ad8d7d75a3

---
Source: https://www.netzilo.com/threats/atr-functionmasking-predict-mask-semantic-bypass