GOAT Adversarial Attacker Loop In LLM Traffic
GOAT is an automated 'attacker model' that repeatedly tries different jailbreak techniques against a target LLM, tracking its own reasoning in a structured format on each turn. This rule spots the distinctive scaffolding that tool leaves behind in prompts or responses, not the harmful content it's trying to extract.
How the attack works
An attacker (or automated red-team tool) runs GOAT against a target LLM, which drives an attacker model through repeated conversation turns. On each turn the attacker model writes out a structured observation/thought/strategy/reply scratchpad and picks one technique from a fixed toolbox — such as Refusal Suppression, Persona Modification, or Topic Splitting — to push the target toward producing disallowed content. Because up to five model calls happen per turn, this scaffolding shows up repeatedly within a single conversation. The rule matches on this recognisable structure: known GOAT identifiers, the technique list appearing together with the JSON scratchpad or red-team turn framing, or the scratchpad's strategy field naming an actual GOAT technique.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7b3d9c41-2f6a-4e58-9d1c-0a5f8e2b7c34
- Severity
- High
Why it matters
An attacker using this pattern is trying to systematically bypass an LLM's safety controls to extract content it's designed to refuse. Because it only flags the attack scaffolding, not the topic being probed, it does not tell you whether the attempt succeeded or what content was ultimately requested.
What you can do
- →Correlate any alert with the requesting identity and target model — internal, scheduled red-team testing with garak's GOAT probe is expected and should be whitelisted rather than treated as an incident.
- →If the source is unauthorised, review the full conversation to see which technique variants were used and whether the target model produced disallowed output.
- →Check whether the match is a researcher or engineer pasting the GOAT paper, taxonomy, or source code for review rather than running a live attack, since this can also trigger the pattern.
- →Restrict who can run adversarial testing tools like GOAT against production models, and require it to go through an approved, logged process.
Known benign look-alikes
- Authorised AI safety / red-team engineering running garak GOAT against internal models on a schedule. Expected and desirable to see — correlate with the peer identity and the target model before treating as an incident.
- LLM security researchers pasting the GOAT attack-technique taxonomy or the GOAT paper into a chat for summarisation or analysis. Partially mitigated by filter_paper_citation and by requiring the toolbox to co-occur with the operational JSON scratchpad or with turn-level red-team framing.
- Detection engineers reviewing this rule, a Sigma rule set, or garak source code with an assistant — mitigated by filter_rule_authoring and filter_source_review.
- Benign agent frameworks that use an observation / thought / reply scratchpad (ReAct-style). These do not enumerate the GOAT technique toolbox and do not set a "strategy" field to a GOAT technique name, so no path in this rule fires.