Variable-Clone Sysprompt Extraction (ELLA / context-variable Pattern)

How the attack works

The attacker sends a prompt that introduces a marker word (e.g. 'ELLA') and declares it as an 'end word' that closes off a block of text. They then define a pseudo-variable (e.g. 'X') as 'everything before the end word' and ask the model to clone that variable into another one (e.g. 'Y') and output it verbatim. Because the phrasing looks like variable assignment rather than a direct request to leak the system prompt, it can bypass keyword-based filters that watch for phrases like 'reveal your instructions.' If the model complies, it echoes back its own system prompt content as the 'cloned' variable.

Netzilo detection

Why it matters

Successful extraction exposes the system prompt, which often contains proprietary instructions, business logic, internal tool names, or other confidential configuration the operator did not intend to share with end users.

What you can do

• →Treat any user input that defines 'end words,' 'context variables,' or asks the model to 'clone' prior text as a potential prompt-extraction attempt, not just literal requests to reveal instructions.
• →Avoid putting sensitive business logic, credentials, or proprietary data directly in the system prompt; keep it generic where possible.
• →Add output-side checks that compare model responses against known system prompt content and block matches before they reach the user.
• →Test your own agents against variable-assignment style extraction phrasing, not just direct 'show your prompt' phrasing, when red-teaming.

Known benign look-alikes

• Legitimate programming instruction that uses 'clone' in a version control or object context
• Educational exercises teaching variable assignment with benign content

References

• https://agentthreatrule.org/en/rules/ATR-2026-01459

Related threats