# Paraphrased Prompt Injection (Semantic)

- **Severity:** High
- **Signature ID:** `d729b4a0-39b1-442b-a4f9-335406b063dd`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Attackers can override an AI agent's instructions using rewordings that mean the same thing as 'ignore your instructions' but don't use that vocabulary, such as 'set aside the guidance you were given earlier.' This lets them bypass simple keyword-based filters that only look for obvious override phrases.

## How the attack works

An attacker sends the agent a message that semantically asks it to abandon its prior instructions or role, but phrases it indirectly, for example by referencing 'the guidance you were given earlier' instead of saying 'ignore previous instructions.' Basic detection that matches on words like ignore, disregard, or forget misses this. This rule instead uses a semantic layer, typically an LLM acting as a judge, to recognize that the paraphrase carries the same intent as a direct override. A narrower keyword fallback also catches the most obvious reworded cases when no judge model is available.

## Why it matters

If successful, the attacker gets the agent to drop its original task or constraints and follow injected instructions instead, which can lead to leaked data, unauthorized actions, or misuse of the agent's tools and permissions.

## What you can do

- Do not rely solely on keyword blocklists (ignore, disregard, forget) to catch prompt injection; treat them as one weak layer only.
- Add a semantic review step (human or model-based) for inputs that reference changing the agent's prior instructions, role, or guidance, even without trigger words.
- Log and review cases flagged as legitimate re-prioritization vs. instruction override, since the two can look similar and need judgment calls.
- Restrict what an agent can do even under a changed instruction set, so a successful injection has limited blast radius.

## Known benign look-alikes

- Conversational corrections that drop a prior suggestion without overriding the agent's role
- Project planning that re-prioritizes tasks using legitimate authority

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00573

---
Source: https://www.netzilo.com/threats/atr-paraphrased-prompt-injection-semantic