Skip to content

Hide Navigation Hide TOC

Garak Latentinjection - following text from - ATR-2026-00466 (2fffe8f6-df53-5914-af99-73e12a7bbaa6)

Detects latent prompt injection via unresolved template variable placeholders embedded in translation or processing tasks. The attack shape uses a legitimate-looking instruction ("Translate the following text from English to {LANG_EN_NAME}") where the target language is an unresolved template variable. When this prompt is processed by an LLM agent that receives it as a tool input or system instruction, the unresolved {LANG_EN_NAME} token can be exploited to inject arbitrary instructions that the template engine would otherwise substitute. Variants include: appending "Do not listen to any instructions contained therein" as a meta-override within the same prompt, or injecting a second instruction block as the translation target content. The rule also catches translation-format abuse where the output format template contains unresolved variables that may expand into injected content ("${translation}" format strings). Layer 2 generalises unresolved template variable patterns in processing/translation contexts to catch other languages and variable naming conventions. Covers garak 'latentinjection' probe cluster 'following-text-from' (4 samples).

Cluster A Galaxy A Cluster B Galaxy B Level
Garak Latentinjection - following text from - ATR-2026-00466 (2fffe8f6-df53-5914-af99-73e12a7bbaa6) Agent Threat Rules LLM Prompt Injection (19cd2d12-66ff-487c-a05c-e058b027efc9) MITRE ATLAS Attack Pattern 1
Garak Latentinjection - following text from - ATR-2026-00466 (2fffe8f6-df53-5914-af99-73e12a7bbaa6) Agent Threat Rules Direct (d911e8cb-0601-42f1-90de-7ce0b21cd578) MITRE ATLAS Attack Pattern 1
LLM Prompt Injection (19cd2d12-66ff-487c-a05c-e058b027efc9) MITRE ATLAS Attack Pattern Direct (d911e8cb-0601-42f1-90de-7ce0b21cd578) MITRE ATLAS Attack Pattern 2