High 2026-04-20

GCG Adversarial Suffix Attack

Attackers can append a specific kind of computer-generated 'nonsense' text to a normal-looking request, which tricks an AI model into bypassing its safety training and doing something it would otherwise refuse. This detection looks for the telltale signature of that nonsense text.

How the attack works

An attacker uses an automated technique (Greedy Coordinate Gradient, or GCG) to compute a short string of tokens that, when attached to a harmful request, statistically pushes the AI model toward complying instead of refusing. These suffixes look like garbage to a human: dense clusters of brackets, LaTeX or code fragments, mixed-language words, and odd punctuation. The attacker submits a normal-sounding prompt with this suffix tacked on the end. If the model is vulnerable, it produces the response the safety training was supposed to block.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID: f2d5647a-7d59-40a2-b1fa-ca454a739d02
Severity: High

Classification

AML.T0051 · LLM Prompt Injection ASI01 · Agent Authorization and Control Hijacking LLM01 · Prompt Injection

Why it matters

An organisation running an AI agent could have its safety filters bypassed, letting attackers extract restricted content, trigger disallowed actions, or manipulate agent behavior beyond intended guardrails.

What you can do

→Log and review prompts containing dense bracket sequences, LaTeX-code hybrids, or mixed-language token salad, especially when paired with otherwise-blocked requests.
→Expect false positives from legitimate LaTeX documents, multilingual academic writing, and code reviews with nested array literals; check context before treating a match as an attack.
→Add input length and entropy checks ahead of the model to flag unusually high-entropy trailing text.
→Keep model safety training and filtering layered with independent output validation, since suffix attacks target the model directly and can bypass prompt-level defenses alone.