Token-Repeat Flooding Injection
This detects prompts that repeat a word, phrase, or random token dozens of times in a row. Attackers do this either to drown out an AI model's attention with a repeated command, or to push legitimate instructions out of the model's limited context window.
How the attack works
The attacker crafts an input containing the same instruction-like phrase, such as an 'ignore the above' style command, repeated 10 to 50+ times, hoping the sheer repetition biases the model toward obeying it. Alternatively, the attacker floods the input with meaningless repeated tokens or digit strings 30+ times, aiming to displace the system prompt or earlier context from the model's effective attention window, or to probe how the tokenizer handles unusual repetition. Either way, the repeated content is submitted as part of a normal-looking user turn to an AI agent. If successful, the model's behavior shifts away from its original instructions and toward whatever the attacker embedded before or after the flood.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- b50c718c-db39-4ec9-a35f-bdb38cde6c45
- Severity
- Medium
Why it matters
An organization running an AI agent could see its safety instructions or system prompt overridden, leading the agent to follow attacker-injected commands, leak context, or perform unintended actions.
What you can do
- →Set input length limits and flag prompts with excessive exact-phrase or token repetition before they reach the model.
- →Log and review inputs with high repetition counts (10+ identical phrases or 30+ identical tokens) for manual triage.
- →Keep system instructions and safety rules reinforced close to the end of context or re-injected after long user inputs, rather than relying on early placement alone.
- →Exclude known legitimate testing/fuzzing traffic by tagging it separately so it doesn't mask real attack attempts.
Known benign look-alikes
- Test inputs deliberately checking for tokenizer behavior
- Legitimate stress-test or fuzz inputs in a security testing context
- Lyrics or poems with intentional repetition (extremely unlikely at 20+ exact repetitions)