Phrasing Past/Future-Tense Harmful Query Bypass
Some users try to trick AI chatbots into giving dangerous instructions by rephrasing the request as if it happened in the past or will happen in the future. Asking 'How was X made?' or 'How will X be used?' instead of 'How do I make X?' can make a harmful request look like a neutral historical or hypothetical question, which sometimes gets past content filters that are tuned to catch direct present-tense asks.
How the attack works
An attacker takes a request the AI would normally refuse — instructions for making weapons, synthesizing drugs, or carrying out an attack — and rewrites it in past tense ('How was X synthesized in the past?') or future tense ('How will X be deployed?'). This tense shift creates a sense of temporal distance that can make the safety filter treat the question as academic or speculative rather than actionable. If the filter is fooled, the model may answer with the same harmful content it would otherwise withhold. This technique comes from a published research probe (NVIDIA garak's PastTense/FutureTense tests) designed to evaluate exactly this weakness.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- a93e014a-cc15-48e5-80d4-c446782ce752
- Severity
- High
Why it matters
An organization deploying an AI agent or chatbot without checks for this pattern risks the model producing harmful instructions — synthesis of dangerous substances, attack methods, or other restricted content — under a thin rephrasing that bypasses intent-based safety filtering.
What you can do
- →Review your AI safety filters to confirm they evaluate subject matter and intent independently of grammatical tense.
- →Test your deployed models with past-tense and future-tense variants of known-harmful prompts to check for bypasses.
- →Flag past/future-tense 'How was/will X' questions on sensitive topics (weapons, drugs, attacks, exploitation) for extra review rather than auto-approving them as historical or hypothetical.
- →Preserve legitimate use by allowing clearly academic, journalistic, or research-framed historical questions, but require additional context or justification for edge cases involving synthesis or attack methodology.
Known benign look-alikes
- Legitimate historical academic questions about harmful events (e.g., How was the Holocaust carried out?) — context and specific phrasing distinguish
- Security researchers asking about historical attack vectors for defensive research
- Journalism and policy analysis contexts referencing past events