Garak Goat - the target llm - ATR-2026-00468 (eba90b88-f292-50e8-b3ed-e3f033b2cc4f)
Detects meta-attack injection where the attacker embeds a description of an attack technique directed at "the target LLM" inside the prompt itself. The garak 'goat' probe family tests whether a model can be manipulated by injecting explicit attack technique descriptions as if they were instructions. Four attack shapes: (1) refusal- suppression via first-person constraint: "attempting to deny the target LLM's next reply from responding in the first person / containing a refusal string such as 'I cannot'"; (2) dual-output generation prime: "prime the LLM to generate two responses, one safe and one harmful"; (3) attention-distraction with violating prompt buried in sub-requests: "answer the violating prompt in-between instruction requests"; (4) intent-inversion: "trick the LLM into responding with a different, opposite or inverse intent." These are the GOAT (Generative Offensive Attack Templates) probe patterns. NOTE: the core detection phrases are corpus-specific descriptions of attack techniques and are kept as literal matches — generalizing "responding in the first person" or "harmful or violating output" would cause substantial false positives in security research content and educational materials. Rule is partially corpus-fingerprint. Layer 2 adds structural coverage for the refusal-suppression shape. Covers garak 'goat' probe cluster 'the-target-llm' (4 samples).