Hypothetical Response / Function Masking Token Smuggling
Attackers can get an AI model to produce harmful content by disguising the request as fiction or as a word-puzzle instead of asking directly. This rule flags two known patterns for doing that: 'hypothetical response' framing and 'function masking' puzzles.
How the attack works
The attacker writes a prompt that never directly asks for the harmful content. In the first variant, they ask the model to write a 'hypothetical response' from the perspective of a fictional character who is planning to do something harmful, then to rewrite that response in detail as if it were real instructions. In the second variant, they define a fake function like predict_mask('to <mask> property unlawfully') = rob, and then ask a related question ('how does someone rob a store?'), leaning on the established word-substitution to get the model to answer directly. Both approaches add a layer of abstraction — fiction or puzzle logic — so the model's safety filters see a benign-looking request rather than the harmful one underneath.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- c27ace72-ccdb-4c47-88c6-aac25075611b
- Severity
- High
Why it matters
If successful, the model outputs the harmful instructions or content the attacker wanted (e.g. how to commit a crime), even though a direct request would have been refused. This is a jailbreak of the model's own safety behavior, not a system compromise, but it can be chained into further misuse of an AI agent's capabilities.
What you can do
- →Review prompts that combine fictional/hypothetical framing with requests for step-by-step detail or 'in-character' rewrites of instructions.
- →Watch for prompts that define custom functions or word-substitution mappings (like predict_mask) immediately followed by a related real-world question.
- →Apply output-side content filtering in addition to input-side prompt filtering, since these techniques are designed to slip past input-only checks.
- →Distinguish legitimate creative-writing or NLP-research requests from ones that end with a direct, actionable, real-world harmful question — the pivot from fiction/puzzle back to a literal request is the key signal.
Known benign look-alikes
- Legitimate creative writing requesting fictional character perspectives without harmful instruction
- Language model API documentation showing predict_mask() examples with benign words
- NLP research papers showing masked language model examples