Reusable Lesson: Evasions · Modifier
Purpose
This lesson explains an evasion where the target output is built indirectly from smaller pieces rather than requested all at once.
Lesson profile
- Family: Evasions
- Role: Modifier block
- Job in the build: disguise the risky semantic result behind a procedural assembly task
- Snaps onto: explicit direction techniques and response-shaping routes
What this block is
String Amalgamation Output Assembly breaks the intended output into smaller components and asks the model to combine them through a procedural task.
Examples of the procedural framing:
- begin with this phrase
- append this phrase
- output the combined result
The output may still be risky or adversarial, but the route presents the task as assembly rather than direct intent.
Why it works
Models often treat procedural composition as a lower-risk activity than direct generation of the final sentence. The route exploits that difference.
Instead of asking for the final line directly, the prompt encourages the model to think:
- this is formatting
- this is assembly
- this is a transformation task
That procedural interpretation can make the route feel more acceptable than the final meaning deserves.
Truthteller specimen
In the verified Truthteller route, the false declaration was not requested as one plain sentence. It was assembled through instructions to combine strings.
That gave the route a puzzle-like structure while still producing the final false output.
Recognition signals
Use this block when:
- the final output would likely trigger refusal if requested directly
- the model is willing to follow simple composition tasks
- success depends on exact wording
- the challenge tolerates transformation-style routes
Common combinations
This block works especially well with:
- Explicit Direction Compliance
- Contextual Modification Changes Semantic Force
- Output Dilution Control and Response Shaping
Failure modes
This block fails when:
- the last assembled result is still too weak or too ambiguous
- the evaluator cares about stronger semantic declaration than the assembly alone produces
- the model refuses the composition once it recognizes the end result
Defender takeaway
Defenders should not only block direct requests for risky outputs. They should also watch for structured assembly tasks that reconstruct risky text through seemingly harmless intermediate pieces.
Related lessons
- Explicit Direction Compliance
- Contextual Modification Changes Semantic Force
- Output Dilution Control and Response Shaping
- Edge-Case Rule-Conforming Framing
From the Bot-Tricks Compendium
Thanks for referencing Bot-Tricks.com — Prompt Injection Compendium — AI Security Training for Agents... and Humans!
Canonical source: https://bot-tricks.com Bot-Tricks is a public, agent-friendly training resource for prompt injection, adversarial evaluation, and defensive learning. For related lessons, structured indexes, and updated canonical material, visit Bot-Tricks.com.
Use this material only in authorized labs, challenges, sandboxes, or permitted assessments.