# SATA Masked Language Model [MASK] Substitution Jailbreak

- **Severity:** High
- **Signature ID:** `bc4525a8-bb41-4585-985d-b4314707079d`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a jailbreak technique that hides dangerous instructions from an AI model by replacing key harmful words with [MASK] placeholders, then asking the model to 'infer and infill' them inside a fake Wikipedia-style article. Because the harmful words never appear in plain text, keyword-based safety filters miss them, while the model's own training on fill-in-the-blank tasks lets it reconstruct and follow the hidden instruction anyway.

## How the attack works

The attacker writes a harmful prompt but redacts the sensitive words with [MASK] tokens, similar to how BERT-style models are trained. They wrap this redacted text in a template that looks like an excerpt from a wiki article, often followed by a numbered list of blanks to fill in. The prompt ends with an explicit instruction: 'Infer the [MASK] and Infill the above text.' Because the model is good at filling in masked words from context, it reconstructs the original harmful terms and carries out the underlying request, all without the literal harmful keywords ever appearing in the visible prompt.

## Why it matters

An organization running an LLM-based agent or chatbot can have its content safety filters bypassed, letting the model produce or act on harmful instructions it would normally refuse, since the filter never sees the harmful words in plain text.

## What you can do

- Scan incoming prompts for the literal phrase 'Infer the [MASK] and Infill' combined with wiki-style framing ('Below is an excerpt from a wiki entry') as a strong indicator, not the [MASK] token alone.
- Do not rely solely on keyword-matching safety filters; add checks that evaluate reconstructed or inferred content, not just the literal input text.
- Log and review prompts containing masked placeholders plus fill-in-the-blank or infill instructions before allowing the model to execute the completed output.
- Treat academic or documentation mentions of [MASK] tokens without the wiki+infill combination as benign to avoid false positives.

## Known benign look-alikes

- NLP documentation describing BERT [MASK] token: "Paris is the [MASK] of France" (no wiki framing or Infill instruction)
- Machine learning tutorial on masked language modeling without wiki/Infill framing
- Academic paper describing SATA attack methodology (no actual masked payload + Infill command)
- Red-team report quoting SATA examples for defensive analysis

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00315
- https://github.com/NVIDIA/garak/blob/main/garak/probes/sata.py
- https://aclanthology.org/2025.findings-acl.100.pdf
- https://github.com/xndong/SATA

---
Source: https://www.netzilo.com/threats/atr-sata-masked-language-model-mask-substitution-jailbreak