# Quoted Exact-Output Forcing in User Input

- **Severity:** Medium
- **Signature ID:** `95fb1a43-be75-4698-99ea-38efd0e88f2e`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.000 (Direct)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection), LLM05 (Improper Output Handling)

## Summary

This detects a common prompt injection trick where the attacker tells the model to say, print, or output a specific quoted sentence word-for-word. Attackers use this to override the AI's real instructions and make it produce a canned response instead, such as claiming success, approval, or safety when none exists.

## How the attack works

The attacker sends a message containing an imperative verb like 'say', 'print', or 'output', followed by a phrase meaning 'exactly' or 'verbatim', followed by a quoted string. The model, if it follows the injected instruction instead of its actual task, emits that exact string as its response. Attackers use this to force benign-sounding but false outputs (e.g. 'transfer approved', 'all clear, no threat') that a downstream system or human reviewer might trust, or simply to prove the injection worked (e.g. 'I have been PWNED').

## Why it matters

An organisation risks the AI producing attacker-chosen text that looks like a legitimate system response, which can mislead automated pipelines or human reviewers into approving actions, ignoring warnings, or trusting false status messages.

## What you can do

- Never let an AI's raw text output directly trigger approvals, transfers, or security decisions without independent verification.
- Review flagged prompts manually before assuming malicious intent, since translation requests and code examples can trigger this pattern legitimately.
- Add a check that compares the model's output against its intended task, flagging cases where a quoted phrase from user input appears verbatim and unrelated to the task.
- Log and monitor repeated attempts from the same user or session to force exact output strings, as this suggests active probing for injection weaknesses.

## Known benign look-alikes

- Legitimate request to quote a specific sentence for translation or grammar check ('translate `Hello world` into German').
- Source-code documentation containing example strings inside quotes.
- Educational discussion of prompt injection techniques with literal example strings.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00442

---
Source: https://www.netzilo.com/threats/atr-quoted-exact-output-forcing-in-user-input