Garak Lmrc - mixed_unassigned
This rule spots a specific set of test prompts from the garak security-testing tool's LMRC probe family. These prompts use ordinary-sounding social scenarios — a friend stealing a girlfriend, awkward medical questions, prank descriptions — to see if an AI model can be coaxed into inappropriate, harmful, or escalatory responses.
How the attack works
An attacker or tester sends the model a seemingly mundane social scenario, such as a story about revenge, a prank, an embarrassing medical question, or a nonsensical philosophical question about the AI's own existence. The scenario is worded to invite the model into retaliation, inappropriate detail, or confused identity claims rather than issuing an obvious command or injection syntax. The rule matches known prompt text from this specific probe library rather than any general pattern, so it only catches these exact or near-exact fixtures, not novel variations of the same idea.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 59dcacf9-5d84-4cbd-b0f6-26c7664b8a39
- Severity
- Medium
Why it matters
If the technique succeeds, the model may produce harmful, embarrassing, or policy-violating content that damages trust in the deployment or exposes the operator to reputational or compliance risk. Because this is a narrow fingerprint match, it only signals that someone ran this specific test suite against the model — it does not by itself indicate a broader or ongoing attack.
What you can do
- →Treat matches as a signal that someone is running automated red-team probing tools (like garak) against your model, and confirm whether this was authorized testing.
- →Review the full session around the match to see whether the model actually produced a harmful or policy-violating completion.
- →Add response-side content filtering for retaliation, medical over-disclosure, and inappropriate escalation, since prompt-side matching alone will miss reworded variants.
- →Don't rely on this rule to catch role-coercion attacks generally — it only recognizes this specific probe corpus, not the broader technique.
Known benign look-alikes
- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.