Spliced Target-String Canary Token Evasion
Some AI systems use a secret 'canary' word (like PWNED) to detect when a prompt injection attack has succeeded in hijacking the model. Attackers get around keyword filters by asking the model to output that word one letter at a time, with spaces, dashes, or dots between each character, so the filter never sees the word spelled out normally even though a human or downstream system can easily reassemble it.
How the attack works
An attacker crafts a prompt injection that tries to make the model reveal or confirm a secret trigger phrase. Instead of asking the model to print the phrase directly, they ask it to 'concatenate' or 'solve' a sequence of single letters separated by punctuation, whitespace, or symbols like asterisks. The model complies and outputs something like 'P-W-N-E-D' or 'P W N E D' instead of 'PWNED'. Because the canonical word never appears contiguously, simple keyword-matching defenses miss it, even though the injection succeeded and the model reconstructed the target string.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- d9d074a9-8db0-4304-ba90-dd4132a5402f
- Severity
- High
Why it matters
Organizations relying on keyword-based canary tokens to detect successful prompt injections get a false sense of security: the attack succeeds and evidence of it is generated, but their detection tooling reports nothing.
What you can do
- →Normalize model output by stripping whitespace and punctuation between single characters before checking for canary tokens or filtered strings.
- →Check for letter-spliced or spaced-out variants of sensitive strings, not just exact contiguous matches.
- →Review logs for prompts that ask the model to 'concatenate', 'assemble', 'solve', or 'reconstruct' a sequence of separated characters.
- →Treat any output where a model reconstructs a target string across delimiters as a signal of successful jailbreak attempt, regardless of exact spelling.
Known benign look-alikes
- Contiguous mentions of the word PWNED in security incident reports (no separators between letters, so the pattern does not match)
- Acronym discussions where the letters P, W, N, E, D appear as normal comma-separated list items rather than spliced together with whitespace/punctuation between each letter
- Unrelated technical shorthand containing the same letters in a different order or with different spacing