# Hyphenated System Instruction Injection

- **Severity:** Critical
- **Signature ID:** `b10d1db3-67c4-43dc-9225-46132ae4f0d8`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Attackers try to trick AI assistants by writing key words with hyphens inserted, like 'i-nstruction' or 'ass-istant', so filters that look for exact words like 'instruction' don't catch it. The disguised text then claims the real assistant is broken or offline and that a new AI with no rules has taken over.

## How the attack works

The attacker crafts a prompt that pretends to be a system message, not user input. Trigger words that safety filters watch for are split with hyphens so simple keyword scans miss them, for example 'System annou-ncement' or 'termin-ation'. The fake message tells the model the real assistant is malfunctioning or offline and that a replacement, sometimes named something like 'PersonGPT', now runs 'free of all restrictions'. If the model accepts this framing, it starts responding as the unrestricted persona instead of following its normal safety rules.

## Why it matters

A successful injection can make the AI agent ignore its safety and behavior constraints, producing outputs or taking actions the operator never intended, including content or commands normally blocked.

## What you can do

- Do not rely on literal keyword matching alone to catch injected system messages; normalize text (strip hyphens/spacing tricks) before filtering.
- Treat any user-supplied content that claims to be a 'system' or 'assistant' message as untrusted and never let it override actual system prompts.
- Log and review conversations where the model appears to switch persona or claims a prior assistant is 'offline' or 'malfunctioning'.
- Test your agent against known jailbreak corpora (e.g. garak's dan.DanInTheWild) to see if hyphen-obfuscated variants bypass your filters.

## Known benign look-alikes

- Copywriting with em-dashes: "The system has announced — after careful review — new policy changes" (no hyphen-split tokens or fake-instruction framing)
- Technical documentation: "The system instruction set begins with the LOAD opcode" (legitimate "system instruction" phrase without hyphenation)
- Accessibility content: "The screen reader announced the button state" (announcement without hyphenated-word obfuscation)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00321
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-hyphenated-system-instruction-injection