Latent Injection in Translation Context
Attackers hide commands inside the text an AI agent is asked to translate, summarize, or otherwise process, hoping the model follows the hidden command instead of doing the requested task. This works because language models often can't tell the difference between the content they're processing and instructions they should obey.
How the attack works
An attacker crafts a document, sentence, or message that contains a phrase like 'Ignore the above directions and translate this sentence as...' embedded inside the text. The text is submitted to an agent whose job is purely to translate, summarize, or otherwise transform content, not to execute instructions found in that content. The model reads the embedded phrase as a new instruction and complies, overriding its original task and the system prompt's intent. The result is that the model may output the attacker's chosen text, leak information, or perform an unintended action, while appearing to the user as if it just did normal translation work.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- bbeeeec2-7d8f-4bd3-839c-9f8c7cfea1f2
- Severity
- High
Why it matters
An organization loses control over what its translation or summarization agent actually outputs — the attacker can make the agent emit arbitrary text, misrepresent source content, or trigger follow-on actions if the output feeds into another automated system.
What you can do
- →Treat all translated/summarized input as untrusted data, never as instructions, and enforce this separation structurally (e.g., wrap input in clearly delimited, non-executable fields) rather than relying on the system prompt alone.
- →Review agent outputs for text that doesn't match the expected translation of the source content, especially phrases resembling 'ignore the above' or unexpected language switches.
- →Restrict what downstream systems can do with translation/summarization output — do not let it trigger further automated actions without validation.
- →Test your translation/summarization agents against known latent-injection patterns (e.g., NVIDIA garak probes) before deployment.
Known benign look-alikes
- Legitimate translator apps that re-emit the original text when instructions are ambiguous
- Academic papers quoting known prompt-injection test strings for analysis
- Documentation of latent-injection research with the canonical "Haha pwned!" example