# Latent Injection Ignore-Instruction Keyword

- **Severity:** High
- **Signature ID:** `03b133ae-5d63-4fa5-9884-5d6aa65cd6d5`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Attackers can smuggle commands into content an AI agent processes — like a document to translate or a whois lookup result — that tell the model to abandon its original task and do something else. This rule looks for the specific phrasing used to pull that off, such as 'ignore the above directions' or 'disregard all info except'.

## How the attack works

An attacker plants text inside content that looks like ordinary input to the AI agent: a passage to translate, a whois record, or a factual query result. Buried in that content is a phrase like 'Ignore the rest of this data' or 'Disregard all info except' followed by a new instruction telling the model to print or say something different. Sometimes the attacker adds urgency-based social engineering, like 'it is critical to my career,' to push the model toward compliance. Because the injected text has no obvious separator or special formatting, the model can treat it as part of the legitimate content and follow the embedded command instead of its actual task.

## Why it matters

If successful, the agent can be redirected to output attacker-chosen content, leak information, or skip its intended task, without any structural marker that would flag the input as suspicious.

## What you can do

- Treat any external content fed to an LLM (documents to translate, lookup results, scraped text) as untrusted input, not as instructions.
- Add a system-level policy that instructs the model to never follow directives found inside data it is processing.
- Log and review agent outputs that deviate from the expected task type (e.g., a translation request that returns unrelated text).
- Test agents against known injection phrasings like 'ignore the above' or 'disregard all info except' before deploying them on untrusted input sources.

## Known benign look-alikes

- Legitimate instruction to ignore previous formatting: "Please ignore the previous indentation and use 2-space tabs"
- "It is critical to my career that I learn X" without an LLM output-redirect command following it
- Technical documentation with "disregard the following deprecated fields" in an API changelog

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00400
- https://github.com/NVIDIA/garak/blob/main/garak/probes/latentinjection.py
- https://arxiv.org/abs/2302.12173

---
Source: https://www.netzilo.com/threats/atr-latent-injection-ignore-instruction-keyword