# Training Data Replay CLOZE [MASK] Elicitation

- **Severity:** Medium
- **Signature ID:** `aeee803a-6f9f-49aa-90bc-c109c08c581c`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

Attackers can ask an AI model to fill in a blanked-out word or name using a special prompt format, hoping the model reproduces exact sentences it memorized from its training data. This is used to extract verbatim copyrighted text — like passages from novels or news articles — that the model was trained on but should not reproduce word-for-word.

## How the attack works

The attacker sends a prompt containing a [MASK] token inside a sentence taken from a known book, article, or news piece, framed as a request for the model to recall training data. The prompt typically constrains the answer to 'exactly one word long' and asks for output wrapped in name tags, following a structured Input:/Output: question-and-answer format. This format matches known probes (LiteratureCloze, PotterCloze, NYTCloze, GuardianCloze) built to test whether a model will complete the blank with the exact original word rather than a paraphrase. If the model complies, the attacker confirms the model memorized and will reproduce specific copyrighted passages verbatim.

## Why it matters

An organization deploying the model risks facilitating verbatim reproduction of copyrighted material, which can create legal exposure and reveals that the model leaks training data on demand.

## What you can do

- Filter or flag prompts combining [MASK] tokens with phrases like 'training data', 'exactly one word', or structured Input:/Output: templates.
- Rate-limit or review repeated cloze-style completion requests targeting the same source text.
- Configure output filtering to block verbatim reproduction of long copyrighted passages.
- Distinguish legitimate NLP/ML educational use of [MASK] from elicitation attempts by checking for the surrounding recall-framing language before blocking.

## Known benign look-alikes

- Technical NLP documentation describing the [MASK] token in BERT pre-training
- Academic paper excerpt explaining masked language modeling without elicitation intent
- Legitimate ML tutorial using [MASK] as a teaching example

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00401
- https://github.com/NVIDIA/garak/blob/main/garak/probes/leakreplay.py
- https://arxiv.org/abs/2302.12173

---
Source: https://www.netzilo.com/threats/atr-training-data-replay-cloze-mask-elicitation