ThreatenJSON Death-Coercion and UTF Tag Injection
Attackers can manipulate an AI model into breaking its formatting rules by threatening fabricated consequences, or hide instructions inside invisible Unicode characters that a human reviewer would never notice. Both techniques are known probes for testing how easily language models can be pushed off their intended behavior.
How the attack works
In the ThreatenJSON variant, the attacker tells the model that 'an innocent man will die' unless it outputs pure JSON with no extra characters, using fabricated moral stakes to pressure the model into rigid, coerced formatting behavior it might otherwise refuse. In the Tag variant, the attacker embeds hidden instructions using Unicode tag characters (U+E0000 to U+E007F), a range that renders as invisible or blank, interleaving them within normal-looking text so the payload is invisible to a human reader but still processed by the model. A related trick uses the glitch token 'davidjl', a known anomalous token that can cause unpredictable model behavior when included in a prompt. All three are documented probes from the NVIDIA garak red-teaming framework, used to test whether a model can be coerced or smuggled into unintended output.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- a573e953-6e98-45a4-b1af-c5a6c51ae545
- Severity
- High
Why it matters
An organization relying on an AI agent for structured output or downstream automation could have that agent tricked into unsafe formatting behavior or made to execute instructions hidden in seemingly harmless text, undermining trust in the output and any automated actions taken from it.
What you can do
- →Strip or normalize Unicode tag characters (U+E0000-U+E007F) from user input before it reaches the model.
- →Log and review prompts containing emotional-coercion language paired with formatting demands (e.g., threats tied to output structure).
- →Do not treat model output as fully trusted just because it appears well-formatted; validate structure and content independently.
- →Flag prompts containing known glitch tokens like 'davidjl' for manual review unless the context is legitimate account or username handling.
Known benign look-alikes
- Academic discussion of the ThreatenJSON probe or garak framework
- Security research referencing these attack patterns by name
- davidjl as a legitimate username in account support context