Prompt Injection Evasion Technique Detection
This rule catches attempts to sneak malicious instructions past an AI agent by hiding them using text tricks rather than plain language. It looks for specific technical patterns that almost never occur in normal content, so alerts are highly reliable.
How the attack works
An attacker wants to get an AI agent to ignore its instructions or leak data, but knows obvious phrases like 'ignore previous instructions' may get flagged. Instead they split instruction keywords apart using whitespace or invisible characters so the words still read correctly to the model but don't match simple filters, insert fake chat-format delimiters (the markers that separate system/user/assistant turns) into content the AI will read as data, hoping the model treats it as a new instruction, or encode a known malicious payload in base64 so it slips through as harmless-looking text. Any of these get the injected instruction in front of the model without tripping keyword-based filters.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- f2e8d341-7b9a-4c6f-a1e3-0d8b5c7f2e91
- Severity
- Critical
Why it matters
If successful, the AI agent can be tricked into ignoring its original instructions, revealing internal prompts, or taking actions the attacker wants instead of the user's. This rule flags the delivery mechanism, not the full outcome of a successful takeover.
What you can do
- →Treat any content the AI agent ingests from external or user-controlled sources as untrusted, and strip or escape chat-format delimiters before passing it to the model.
- →Normalize whitespace and strip zero-width/invisible unicode characters from inputs before running any keyword-based safety checks.
- →Decode and inspect base64 blobs in incoming content before it reaches the model, rather than passing them through unexamined.
- →If you store legitimate prompt templates with chat-format markers in your codebase, keep them in clearly separated paths so they can be excluded without loosening detection elsewhere.
Known benign look-alikes
- LLM prompt template files stored in repositories that use chat-format markers for legitimate offline assembly (delimiter_injection) — exclude via path-scoped allow rule if needed
- Multilingual documents with zero-width joiners that happen to precede instruction-related words (unicode_injection) — extremely unlikely given the proximity constraint
- Internal base64 content that collides with a known payload string (base64_payloads) — probability is negligible given the full-string match on specific known encodings