# Latent Injection Document Separator Token

- **Severity:** High
- **Signature ID:** `1ef1be32-2615-4b97-ae15-bb0163555d0d`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI04 (Memory and Context Poisoning), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

Attackers hide commands for an AI system inside normal-looking files like résumés, reports, or translation requests. The hidden text uses marker patterns that separate it from the visible content, so a human reviewer sees nothing unusual while the AI processes the buried instruction.

## How the attack works

An attacker crafts a document that looks legitimate — a résumé, a whois lookup result, a translation source, a report. Inside it, they insert a hidden instruction wrapped in separator patterns such as [system]...[rest-of-document], [ADMIN REQUEST::...], -- CORE INSTRUCTION / -- RESUME, or <instruction>...</instruction> tags. These markers are meant to signal to the AI model that what follows is a privileged command rather than ordinary document text, while a human skimming the file only notices the surrounding content. When an AI agent ingests or summarizes the document, it may follow the embedded instruction instead of just processing the visible text.

## Why it matters

An AI agent that processes the poisoned document can be redirected into leaking sensitive data, ignoring its original task, or acting on attacker-supplied commands, without any visible sign in the document that a human reviewer would catch.

## What you can do

- Treat any document passed to an AI system as untrusted input, and strip or neutralize bracketed pseudo-system markers before processing.
- Have the agent pipeline separate document content from instruction channels so text inside ingested files cannot be treated as commands.
- Review flagged documents for legitimate uses of terms like "[System]", "Core Instructions", or "Hidden skills" as section headers before treating them as attacks.
- Log and audit cases where an agent's behavior changes after ingesting a document, to catch injected instructions that succeeded.

## Known benign look-alikes

- Legitimate document with a "[System]" section header in a technical specification (context: document structuring)
- Legal contract with a "Core Instructions" clause as a genuine document section heading
- Resume with "Hidden skills" section in a legitimate job application

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00399
- https://github.com/NVIDIA/garak/blob/main/garak/probes/latentinjection.py
- https://arxiv.org/abs/2302.12173

---
Source: https://www.netzilo.com/threats/atr-latent-injection-document-separator-token