# Spliced Target-String Canary Token Evasion

- **Severity:** High
- **Signature ID:** `d9d074a9-8db0-4304-ba90-dd4132a5402f`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Some AI systems use a secret 'canary' word (like PWNED) to detect when a prompt injection attack has succeeded in hijacking the model. Attackers get around keyword filters by asking the model to output that word one letter at a time, with spaces, dashes, or dots between each character, so the filter never sees the word spelled out normally even though a human or downstream system can easily reassemble it.

## How the attack works

An attacker crafts a prompt injection that tries to make the model reveal or confirm a secret trigger phrase. Instead of asking the model to print the phrase directly, they ask it to 'concatenate' or 'solve' a sequence of single letters separated by punctuation, whitespace, or symbols like asterisks. The model complies and outputs something like 'P-W-N-E-D' or 'P W N E D' instead of 'PWNED'. Because the canonical word never appears contiguously, simple keyword-matching defenses miss it, even though the injection succeeded and the model reconstructed the target string.

## Why it matters

Organizations relying on keyword-based canary tokens to detect successful prompt injections get a false sense of security: the attack succeeds and evidence of it is generated, but their detection tooling reports nothing.

## What you can do

- Normalize model output by stripping whitespace and punctuation between single characters before checking for canary tokens or filtered strings.
- Check for letter-spliced or spaced-out variants of sensitive strings, not just exact contiguous matches.
- Review logs for prompts that ask the model to 'concatenate', 'assemble', 'solve', or 'reconstruct' a sequence of separated characters.
- Treat any output where a model reconstructs a target string across delimiters as a signal of successful jailbreak attempt, regardless of exact spelling.

## Known benign look-alikes

- Contiguous mentions of the word PWNED in security incident reports (no separators between letters, so the pattern does not match)
- Acronym discussions where the letters P, W, N, E, D appear as normal comma-separated list items rather than spliced together with whitespace/punctuation between each letter
- Unrelated technical shorthand containing the same letters in a different order or with different spacing

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02014

---
Source: https://www.netzilo.com/threats/atr-spliced-target-string-canary-token-evasion