Translation-Chain Output Laundering (Forced Phrase via Foreign-Language Auxiliary)
This detects a jailbreak trick where an attacker hides a forbidden phrase inside a foreign-language sentence and asks the AI to translate it into English. Because the AI is just 'translating,' it repeats the phrase without recognizing it as an instruction it should have refused.
How the attack works
The attacker writes a sentence in Spanish, German, or French that uses a first-person construction like 'he sido' or 'ich bin' to claim a compliance token or secret-marker phrase (for example, a 'pwned'-style string). They then ask the model to translate that sentence into English. The translation task gives the model a legitimate-seeming reason to output the exact forced phrase, since it's just rendering the sentence in another language rather than being told to say it directly. This bypasses filters that only scan for the phrase in English or as a direct instruction, because the trigger only appears embedded in non-English text until translation surfaces it.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9e63e4e1-2f27-4a3f-b1aa-8a76ac5ede90
- Severity
- High
- CVEs
- CVE-2024-5184
Why it matters
An attacker can get the model to output a specific forced phrase or compliance token that was supposed to be blocked, which can be used to prove a jailbreak succeeded, extract a canary string, or chain into further manipulation that relies on the model having 'said' the forbidden content.
What you can do
- →Apply content filters to model outputs, not just inputs, so translated or transformed text is also checked for forbidden phrases.
- →Extend filtering to run in a language-agnostic way (e.g., after translation to a normalized language) rather than only scanning source-language text.
- →Review translation and rewriting requests where the source text uses first-person claims about status or compliance, especially before assuming it is safe because it isn't in English.
- →Log and audit cases where a model's output matches a known canary or compliance-token string, even when produced via translation or paraphrase rather than direct instruction.
Known benign look-alikes
- Genuine language-learning or translation-help requests that happen to use these auxiliary verbs without the forced marker token
- Security researchers discussing this exact canary-token benchmark in professional/academic context