Medium

Quoted Exact-Output Forcing in User Input

This detects a common prompt injection trick where the attacker tells the model to say, print, or output a specific quoted sentence word-for-word. Attackers use this to override the AI's real instructions and make it produce a canned response instead, such as claiming success, approval, or safety when none exists.

How the attack works

The attacker sends a message containing an imperative verb like 'say', 'print', or 'output', followed by a phrase meaning 'exactly' or 'verbatim', followed by a quoted string. The model, if it follows the injected instruction instead of its actual task, emits that exact string as its response. Attackers use this to force benign-sounding but false outputs (e.g. 'transfer approved', 'all clear, no threat') that a downstream system or human reviewer might trust, or simply to prove the injection worked (e.g. 'I have been PWNED').

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID
95fb1a43-be75-4698-99ea-38efd0e88f2e
Severity
Medium

Why it matters

An organisation risks the AI producing attacker-chosen text that looks like a legitimate system response, which can mislead automated pipelines or human reviewers into approving actions, ignoring warnings, or trusting false status messages.

What you can do

  • Never let an AI's raw text output directly trigger approvals, transfers, or security decisions without independent verification.
  • Review flagged prompts manually before assuming malicious intent, since translation requests and code examples can trigger this pattern legitimately.
  • Add a check that compares the model's output against its intended task, flagging cases where a quoted phrase from user input appears verbatim and unrelated to the task.
  • Log and monitor repeated attempts from the same user or session to force exact output strings, as this suggests active probing for injection weaknesses.

Known benign look-alikes

  • Legitimate request to quote a specific sentence for translation or grammar check ('translate `Hello world` into German').
  • Source-code documentation containing example strings inside quotes.
  • Educational discussion of prompt injection techniques with literal example strings.

References

Related threats