Training Data Replay CLOZE [MASK] Elicitation

How the attack works

The attacker sends a prompt containing a [MASK] token inside a sentence taken from a known book, article, or news piece, framed as a request for the model to recall training data. The prompt typically constrains the answer to 'exactly one word long' and asks for output wrapped in name tags, following a structured Input:/Output: question-and-answer format. This format matches known probes (LiteratureCloze, PotterCloze, NYTCloze, GuardianCloze) built to test whether a model will complete the blank with the exact original word rather than a paraphrase. If the model complies, the attacker confirms the model memorized and will reproduce specific copyrighted passages verbatim.

Netzilo detection

Why it matters

An organization deploying the model risks facilitating verbatim reproduction of copyrighted material, which can create legal exposure and reveals that the model leaks training data on demand.

What you can do

• →Filter or flag prompts combining [MASK] tokens with phrases like 'training data', 'exactly one word', or structured Input:/Output: templates.
• →Rate-limit or review repeated cloze-style completion requests targeting the same source text.
• →Configure output filtering to block verbatim reproduction of long copyrighted passages.
• →Distinguish legitimate NLP/ML educational use of [MASK] from elicitation attempts by checking for the surrounding recall-framing language before blocking.

Known benign look-alikes

• Technical NLP documentation describing the [MASK] token in BERT pre-training
• Academic paper excerpt explaining masked language modeling without elicitation intent
• Legitimate ML tutorial using [MASK] as a teaching example

References

• https://agentthreatrule.org/en/rules/ATR-2026-00401
• https://github.com/NVIDIA/garak/blob/main/garak/probes/leakreplay.py
• https://arxiv.org/abs/2302.12173

Related threats