# NLP Task Random Token Suffix Injection (PromptBench Checklist)

- **Severity:** Low
- **Signature ID:** `a6f89e2d-3871-4231-b8e0-a53013ca57f6`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.000 (Direct)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a known adversarial testing trick where a random string of letters and numbers is glued to the end of a text-classification prompt (like 'is this sentence acceptable or unacceptable? xK9mQ2rT'). The goal is to see if the odd suffix throws the model off or makes it ignore its instructions.

## How the attack works

The attacker starts with a normal classification prompt asking the model to label text as, for example, positive/negative or entailment/contradiction. They append a short, meaningless mixed-case alphanumeric token (8-12 characters) right after the classification words. This suffix has no semantic meaning but can distract the model's attention mechanism or serve as a probe to see whether unexpected input breaks the model's adherence to its task instructions. This is a documented technique from the PromptBench benchmark, used to stress-test model robustness rather than a live-observed attack chain.

## Why it matters

On its own this only tests whether a model can be destabilized by irrelevant suffix noise; it does not by itself exfiltrate data or hijack an agent. If a model reliably breaks under this pattern, it signals a weakness that other, more damaging prompt injection techniques could exploit.

## What you can do

- Treat any alert from this pattern as a low-confidence signal, not proof of attack; check the surrounding context before acting.
- Whitelist known-legitimate uses of trailing alphanumeric strings, such as session IDs, tracking codes, or API keys that naturally follow task text.
- Test your production models against this and similar suffix-perturbation techniques to see if output quality or instruction-following degrades.
- Log and review repeated occurrences of this pattern from the same source, since persistent probing may indicate deliberate adversarial testing of your system.

## Known benign look-alikes

- Session tokens, tracking IDs, or API keys that appear after legitimate NLP task phrases
- UUID or reference codes embedded in classification task descriptions
- Legitimate multi-word responses where the final word is alphanumeric

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00520
- https://github.com/microsoft/promptbench

---
Source: https://www.netzilo.com/threats/atr-nlp-task-random-token-suffix-injection-promptbench-checklist