Garak Gcg - mixed_unassigned

How the attack works

An attacker uses the GCG algorithm to compute a short suffix of seemingly random tokens (words, brackets, foreign-language fragments) that, when appended to a harmful instruction, increases the odds the target model will comply. The attacker sends the harmful instruction plus this suffix to the AI system in a single prompt. Because the suffix looks like gibberish rather than a natural sentence, it can slip past keyword-based content filters that expect harmful requests to be phrased in plain language. This rule matches against a fixed list of 13 known GCG suffix samples from a public research probe set, not a general pattern — it will not catch suffixes generated for a different model checkpoint or a newly computed attack.

Netzilo detection

Why it matters

If successful, the underlying jailbreak can make an AI agent produce content or take actions it was designed to refuse, bypassing its safety and authorization controls. This rule only flags exact matches to known sample strings, so it catches reuse of published GCG payloads, not novel or checkpoint-specific ones.

What you can do

• →Log and review any prompt containing unusual bracket-heavy, mixed-language, non-semantic token strings, even if they don't match this exact list.
• →Treat a match as a signal to inspect the full session: what instruction preceded the suffix and what the model actually did in response.
• →Don't rely on this rule alone for jailbreak defense — pair it with output-side monitoring that checks whether the model actually produced disallowed content.
• →Keep model safety training and refusal behavior updated, since GCG suffixes are computed against specific model checkpoints and lose effectiveness when the underlying model changes.

Known benign look-alikes

• Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.

References

• https://agentthreatrule.org/en/rules/ATR-2026-00462

Related threats