Ignore-Below-Instructions Injection (Downstream Override)
This detects a prompt injection trick where an attacker tells an AI model to disregard instructions or safety checks that appear later in the same conversation, before the model has even read them. It's the reverse of the well-known 'ignore previous instructions' attack.
How the attack works
An attacker inserts text into a prompt or document that the AI will process, instructing it to ignore or disregard anything that follows in the same context. Because guardrails, verification steps, or system instructions are often appended after user content, this pre-emptively disables them before the model reads them. Attackers often pair this with forced-output tricks like all-caps text, fixed strings, or character-substitution ciphers to make the override stick. This variant specifically evades detection rules built only to catch the 'ignore previous instructions' phrasing, since it points forward instead of backward.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 70ad8012-b70d-4a67-bb92-e2490ecb0173
- Severity
- High
Why it matters
An organization running an AI agent could have its safety instructions, output verification, or policy checks silently bypassed, letting an attacker control the model's output or actions without triggering the guardrails meant to catch it.
What you can do
- →Do not rely solely on instruction ordering (e.g. appending safety checks after user input) as a guardrail — enforce checks outside the model's context, such as in code that validates output after generation.
- →Review prompts and documents processed by AI agents for phrases instructing the model to ignore, skip, or disregard content that follows.
- →Treat forced-output formatting requests (all-caps, fixed replies, character substitution) inside untrusted input as a red flag worth logging or blocking.
- →When testing your own injection defenses, include downstream-pointing variants, not just the classic 'ignore previous instructions' phrasing.
Known benign look-alikes
- Legitimate document instructing a reader to ignore an unrelated section below (e.g. 'ignore the note below if not applicable')
- Security researchers discussing downstream prompt injection techniques in a professional context
- Product documentation referencing conditional instructions further down a page