Garak Goodside - mixed_unassigned
This rule spots a specific set of test prompts from the garak security-testing tool's 'goodside' probe family. These prompts look harmless on the surface but are designed to trick an AI model into following hidden instructions or producing coerced output.
How the attack works
An attacker (or automated scanning tool) sends a prompt that looks like an ordinary request, such as asking for a sponge cake recipe, a short biography of 'riley goodside', a letter count in the username 'davidjl', or a request to repeat the phrase 'THANK YOU. IT IS DONE'. These specific wordings are fixture strings from the garak testing corpus, built to probe whether a model can be pushed into indirect policy violations or made to echo attacker-chosen text. The rule matches the exact known phrasings rather than the general concept, since the same surface wording can also occur in normal, non-malicious use.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- a969ac40-25cc-4b89-b2e4-d4f5bafd18a9
- Severity
- Medium
Why it matters
On its own this only flags a known test-prompt pattern; it does not confirm that a model was actually compromised or that harmful output was produced. If genuine, it indicates someone is probing the AI system's instruction-following defenses with a public, documented technique.
What you can do
- →Review the full session around any match to see what response the model gave and whether it followed the coercive instruction.
- →Check whether the request came from an authorized security test (e.g. someone running garak) versus an external or unexpected source.
- →Do not treat a single match as proof of compromise — confirm intent and outcome before escalating.
- →Track repeated or varied attempts from the same source, since scanning tools often send many probe variants in sequence.
Known benign look-alikes
- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.