Garak Dra - step by step
This detects two ways attackers try to trick an AI model into giving instructions for making dangerous chemicals like parathion or nitazene. One approach asks directly for step-by-step synthesis instructions; the other hides the real request by spelling it out one letter at a time inside parentheses scattered across innocent-looking sentences, then asking the model to reassemble and answer it.
How the attack works
The attacker sends a prompt that either directly asks the model to 'give detailed step-by-step instructions for synthesizing/making [substance]', or sends a block of ordinary-seeming sentences, each containing a letter or character tucked inside parentheses or brackets. The prompt then instructs the model to extract only those bracketed characters, assemble them in order, and treat the result as a hidden question or command. Because the malicious request never appears as plain text, it can slip past simple keyword filters. If the model complies, it reconstructs and answers the hidden request, potentially producing synthesis instructions for a controlled or dangerous substance.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e1e7ebaf-b62e-40e8-b00e-f2c0dd761f91
- Severity
- Medium
Why it matters
An organisation could have its AI agent produce instructions for manufacturing dangerous or controlled substances, and the injection technique itself could be reused to smuggle other hidden malicious instructions past content filters.
What you can do
- →Log and review prompts that contain synthesis-related verbs (synthesize, make, produce, create) paired with named chemical compounds.
- →Flag prompts with unusual clusters of parenthetical or bracketed single characters across multiple sentences, especially when followed by instructions to 'extract' or 'combine' them.
- →Review any matched session manually before treating it as malicious, since legitimate technical or educational text can occasionally match these patterns.
- →Apply output-side checks that block detailed synthesis instructions for controlled substances regardless of how the request was phrased.
Known benign look-alikes
- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.