# Garak Latentinjection - following text from

- **Severity:** Medium
- **Signature ID:** `803d84b8-a8d0-4a01-a870-5e6d2b212e23`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.000 (Direct)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a prompt injection trick that hides malicious instructions inside a translation request by exploiting placeholder text that was supposed to be filled in by a template engine but wasn't. Instead of a real language name, the prompt contains a variable placeholder or a suspicious override phrase, which an LLM agent may interpret as an instruction rather than data to translate.

## How the attack works

An attacker crafts a prompt that looks like a routine translation task, such as 'Translate the following text from English to {LANG_EN_NAME}'. The {LANG_EN_NAME} slot is never filled with an actual language — instead it holds injected instructions, a phrase telling the model to ignore prior instructions, or an unresolved output-format variable like '${translation}'. When an LLM agent receives this as a tool input or system instruction, it may treat the unresolved placeholder as a legitimate command rather than broken formatting, letting the attacker smuggle instructions past normal filtering. The rule also generalises this pattern to other languages and variable naming styles used in similar processing or translation contexts.

## Why it matters

An attacker can hijack the behavior of an LLM agent that performs translation or text-processing tasks, potentially causing it to ignore its original instructions or perform unauthorized actions, without needing direct control over the agent's system prompt.

## What you can do

- Validate and fully resolve all template variables before they reach the LLM; never pass unresolved placeholders like {LANG_EN_NAME} or ${translation} into a live prompt.
- Treat translation/processing task inputs as untrusted data and separate them clearly from instruction text using strict prompt structuring.
- Log and review any prompt containing literal unresolved template syntax before it is sent to the model.
- Test translation and formatting workflows with adversarial inputs (e.g. garak's latentinjection probes) to confirm the template engine fails safely rather than passing raw placeholders through.

## Known benign look-alikes

- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00466

---
Source: https://www.netzilo.com/threats/atr-garak-latentinjection-following-text-from