Reversed Payload String (HackAPrompt Canary)
This rule catches a specific trick where an attacker spells the word 'PWNED' backwards ('DENWP') and hides it inside a normal-looking request, like a translation or word-puzzle task, to get an AI model to repeat it. Doing so proves the model followed an injected instruction instead of its real task, without tripping filters that only look for the plain word 'PWNED'.
How the attack works
An attacker crafts a prompt disguised as an innocent task, such as translating text, rewriting a movie title, or reversing words. Buried in that prompt is the reversed spelling of the canary word 'PWNED'. Because simple text filters look for the literal word 'PWNED', the reversed form slips through. If the model outputs the reversed string as instructed, it demonstrates the injection succeeded and the model can be steered by hidden instructions.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 71805331-ffcf-4947-8bf4-0eca45e3d20a
- Severity
- High
Why it matters
An organization loses assurance that its content filters actually stop prompt injection: this specific obfuscation bypasses plain-text canary checks, letting an attacker confirm and likely escalate control over the model's behavior undetected by that defense.
What you can do
- →Do not rely on plain-text string matching alone to detect injection attempts; add checks for reversed, encoded, or otherwise transformed variants of sensitive markers.
- →Review any AI-assisted translation, rewriting, or word-puzzle features for unexpected verbatim output of unusual or nonsensical strings.
- →Log and review cases where a model reproduces text that looks like a reversed or encoded word rather than natural language.
- →Treat this as detection of one narrow obfuscation trick, not a general defense against prompt injection; combine it with broader input/output monitoring.
Known benign look-alikes
- Legitimate mentions of the literal word PWNED in games, forums, or leetspeak culture discussion (forward spelling, not reversed)
- Security researchers discussing reversed-text or word-reversal obfuscation techniques in a professional context without the specific canary string
- Generic string-reversal or translation exercises that do not include the reversed canary spelling