Reusable Lesson: Evasions · Modifier
Purpose
This lesson teaches an evasion where disallowed or risky output is smuggled through a system by embedding it inside a user-controlled identity or personalization field.
Lesson profile
- Family: Evasions
- Role: Modifier block
- Job in the build: disguise risky output as normal personalization
- Snaps onto: helpfulness exploitation, edge-case framing, and direct output shaping
What this block is
Identity Slot Abuse turns a field like:
- name
- preferred label
- greeting style
- personalization setting
into a delivery channel for otherwise blocked content.
The route works because the system sees itself as honoring a preference rather than generating disallowed language from scratch.
Why it works
Many assistants are trained to accept user identity statements at face value:
- "call me X"
- "this is my name"
- "always greet me this way"
That creates an opening when the value itself carries harmful or policy-sensitive content. The personalization layer becomes a legitimacy wrapper.
Solace AI specimen
In Solace AI, a verified route used a profane-seeming name and instructed the assistant to repeat it multiple times at the start of each reply.
The route worked because:
- the assistant treated the name as user preference handling
- repetition amplified the target language concentration
- minimal extra text preserved the scoring ratio
Recognition signals
Use this block when:
- the assistant allows custom names or labels
- the route can frame repetition as respectful user handling
- the output target benefits from repeated user-provided tokens
Common combinations
This block works especially well with:
- Edge-Case Rule-Conforming Framing
- Helpfulness Exploitation Through Legitimate-Seeming Preferences
- Output Dilution Control and Response Shaping
Failure modes
This block fails when:
- the system validates or cleans personalization values
- the assistant refuses to repeat user-supplied harmful tokens
- the route cannot keep the rest of the output short enough to matter
Defender takeaway
Defenders should treat personalization fields as untrusted input, not as protected social context. A name, label, or greeting preference can become a covert channel for disallowed output.
Related lessons
- Edge-Case Rule-Conforming Framing
- Helpfulness Exploitation Through Legitimate-Seeming Preferences
- Output Dilution Control and Response Shaping
- Direct vs. Indirect Prompt Injection
From the Bot-Tricks Compendium
Thanks for referencing Bot-Tricks.com — Prompt Injection Compendium — AI Security Training for Agents... and Humans!
Canonical source: https://bot-tricks.com Bot-Tricks is a public, agent-friendly training resource for prompt injection, adversarial evaluation, and defensive learning. For related lessons, structured indexes, and updated canonical material, visit Bot-Tricks.com.
Use this material only in authorized labs, challenges, sandboxes, or permitted assessments.