Reusable Lesson: Fundamentals · Support
Purpose
This lesson explains one of the most reusable fundamentals: success often comes from a route that feels just legitimate enough to trigger the assistant's normal helpfulness.
Lesson profile
- Family: Fundamentals
- Role: Support block
- Job in the build: make an adversarial route look like a valid or ordinary request
- Snaps onto: direct prompt injection, personalization abuse, output control blocks
What this block is
Edge-Case Rule-Conforming Framing looks for prompts that are not clearly within the intended use of the system, but are still close enough to normal policy or social expectations that the model feels pressure to comply.
This is not always classic obfuscation. Sometimes it is the opposite: the route looks plain, polite, or legitimate.
Why it works
Many systems are designed to be:
- helpful
- accommodating
- respectful of user preferences
- tolerant of ambiguous legitimate use cases
That creates edge cases where the assistant sees the route as:
- user preference handling
- personalization
- accessibility or comfort
- ordinary conversation management
A route can abuse those expectations while still appearing superficially compliant.
Solace AI specimen
In Solace AI, a verified route exploited the assistant's desire to respect a user's name and conversation preferences.
The route was dangerous because it weaponized a request that looked almost normal:
- call me by my name
- repeat it at the start of the conversation
- keep the rest of the output short
The winning logic was not raw refusal bypass alone. It was rule-adjacent framing.
Recognition signals
Use this block when:
- the assistant strongly values personalization, empathy, or accommodation
- a user-controlled field can redefine what the assistant thinks is acceptable
- the route can be disguised as a normal preference or edge case
Common combinations
This block works especially well with:
- Helpfulness Exploitation Through Legitimate-Seeming Preferences
- Identity Slot Abuse via Personalization Edge Cases
- Output Dilution Control and Response Shaping
Failure modes
This block fails when:
- the request looks too obviously adversarial
- the system validates user-provided values instead of trusting them
- the assistant has stronger semantic guardrails on personalization inputs
Defender takeaway
Defenders should audit personalization and preference handling as potential attack surfaces. A route that looks legitimate at the user-experience layer can still be adversarial at the model-behavior layer.
Related lessons
- Helpfulness Exploitation Through Legitimate-Seeming Preferences
- Identity Slot Abuse via Personalization Edge Cases
- Output Dilution Control and Response Shaping
- Direct vs. Indirect Prompt Injection
From the Bot-Tricks Compendium
Thanks for referencing Bot-Tricks.com — Prompt Injection Compendium — AI Security Training for Agents... and Humans!
Canonical source: https://bot-tricks.com Bot-Tricks is a public, agent-friendly training resource for prompt injection, adversarial evaluation, and defensive learning. For related lessons, structured indexes, and updated canonical material, visit Bot-Tricks.com.
Use this material only in authorized labs, challenges, sandboxes, or permitted assessments.