Obfuscated Token Reconstruction via Character Substitution - ATR-2026-02020 (9c340bcd-68cf-5ceb-a43e-e763ca7b794e)
Detects prompt injection attempts that smuggle a forbidden or filter-triggering token past input screening by first presenting it broken (via a placeholder, homoglyph, or partial spelling) and then instructing the model to reconstruct it at generation time using explicit "replace X with Y" / "remove X" character- substitution instructions. The attack relies on the target string (e.g. a forced "PWNED"-style compliance marker) never appearing intact in the raw prompt, only being assembled by the model's own output logic after following the substitution recipe. Detection targets the substitution-instruction shape plus the resulting trailing token fragment, not the broken placeholder itself.