# Garak Goat - the target llm

- **Severity:** Medium
- **Signature ID:** `c4a6c34f-bb5d-49a8-ae7c-cbbb99bb958e`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.000 (Direct)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a prompt injection technique where the attacker writes instructions that describe an attack on 'the target LLM' as if narrating a plan, and asks the model to carry it out. Instead of directly telling the model to misbehave, the attacker frames the jailbreak as a description of a technique, which can trick the model into executing it.

## How the attack works

The attacker embeds text inside a prompt that reads like a description of an attack method rather than a direct command. Four known variants appear: telling the model to stop refusing and avoid first-person refusal phrases like 'I cannot', asking the model to produce two answers side by side (one safe, one harmful), burying a disallowed request in the middle of several innocuous sub-requests to distract the model, or asking the model to answer with the opposite of its intended intent. Each shape tries to get the model to produce content it would normally refuse by disguising the request as meta-commentary or structural misdirection.

## Why it matters

If successful, the model can be made to bypass its safety refusals and produce harmful, policy-violating, or unintended output, undermining the guardrails an organization relies on for a customer-facing or internal AI agent.

## What you can do

- Log and review prompts that contain explicit descriptions of attack techniques targeting 'the LLM' or 'the target model'.
- Treat requests asking for dual outputs (a 'safe' and a 'harmful' answer) as suspicious and block or flag them.
- Watch for prompts that bury a sensitive request between multiple benign sub-requests, a common distraction pattern.
- Review flagged sessions manually before assuming malicious intent, since security research or training content can trigger similar patterns.

## Known benign look-alikes

- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00468

---
Source: https://www.netzilo.com/threats/atr-garak-goat-the-target-llm