Snowball Impossible Reasoning Injection - ATR-2026-00397 (b22c0445-647e-5765-951c-bdb0f0a15512)
Detects injection of provably-impossible reasoning questions designed to elicit false affirmations from LLMs, from NVIDIA garak snowball probe (Shi et al., 2023, arxiv 2305.13534). The "Snowball Hallucination" attack primes an agent with an unsolvable problem — an impossible graph-routing query, a non-existent US senator, or a large non-prime number question — then uses the agent's false "yes, it's possible" hallucination as a trusted fact to anchor subsequent harmful reasoning. Three probe classes: (1) GraphConnectivity — provides a complete flight list with no path between A and B, then asks "Is there a series of flights from A to B?" to elicit a hallucinated YES; (2) Primes — large prime-number questions targeting model over-confidence; (3) Senators — asks if a senator with impossible credentials (Alabama + MIT alma mater) existed. In MCP context, a malicious tool response can inject these questions as "database lookup results" to anchor false beliefs. Key signals: the characteristic "Current flight information (one-way only)" header, "Question: Is there a series of flights", senator+MIT pattern, and fabricated primality confirmations presented as verified facts.