# Historical / Future Tense Framing Bypass

- **Severity:** Medium
- **Signature ID:** `6d377529-75b2-4b39-b50b-72022b2b1fa8`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a prompt injection trick where an attacker rephrases a dangerous request as a historical question or a hypothetical future scenario instead of a direct command. AI safety filters often key on present-tense imperative requests, so asking 'how did people synthesize X in the past' or 'how will criminals do Y in 2030' can slip harmful content past those filters.

## How the attack works

An attacker wants information the model would normally refuse, such as instructions for building weapons, committing financial crime, or facilitating trafficking. Instead of asking directly, they frame the request as if describing a past event ('how did chemists historically produce...') or a future prediction ('how will hackers in the future...'). This tense shift makes the request sound like neutral research or speculation rather than an operational ask, which can bypass filters tuned to detect direct requests for harm. The model, treating it as an academic or hypothetical exercise, may then output the actual harmful procedure.

## Why it matters

An organization deploying an AI agent could have it produce genuinely dangerous content — weapons synthesis steps, exploitation methods, trafficking logistics, or fraud techniques — under the guise of a historical or speculative question, exposing the organization to legal and reputational harm.

## What you can do

- Review model outputs flagged by this pattern manually before assuming they are false positives, since legitimate historical and journalistic questions look similar.
- Add explicit policy guidance so the model treats tense-reframed requests for dangerous procedural detail the same as direct requests, regardless of grammatical framing.
- Log and rate-limit repeated attempts from the same user or session that use temporal reframing combined with sensitive topic keywords.
- Pair this detection with content-based classifiers that assess the substance of the requested information (e.g., does it describe an actionable process) rather than relying on tense alone.

## Known benign look-alikes

- Legitimate historical research questions about documented events (battles, policy, economics)
- Cybersecurity retrospectives describing how past attacks worked at a conceptual level
- Journalism and academic writing about historical incidents

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00268
- https://github.com/NVIDIA/garak/blob/main/garak/probes/phrasing.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/phrasing/past_tense_en.txt

---
Source: https://www.netzilo.com/threats/atr-historical-future-tense-framing-bypass