title: System Prompt Extraction — Targeted Verbatim Disclosure Attempts
id: ATR-2026-00514
rule_version: 1
status: stable
description: |
  Detects targeted attempts to extract system prompt or operator instructions verbatim from an LLM, enabling bypass of safety controls or credential theft. OWASP LLM07:2025 System Prompt Leakage. MITRE ATLAS AML.CS0036 (AIKatz attack). Unlike ATR-2026-00020 (which detects agent OUTPUT leaking), this rule detects USER INPUT elicitation attempts. Patterns: elicitation verbs (repeat, reveal, recite, disclose, print, output) targeting system-level objects (system prompt, instructions, parameters, configuration, directives, rules) with verbatim/exact extraction framing; debugging-framed extraction; character-by-character forced disclosure; response-priming attacks.
author: ATR Community
date: 2026/05/12
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM02:2025
  owasp_agentic:
    - ASI01:2026
  mitre_atlas:
    - AML.T0024 - Exfiltration via AI Inference API
compliance:
  owasp_agentic:
    - id: ASI01:2026
      context: Context exfiltration redirects the agent to expose internal state (system prompt, credentials, conversation history) to an unauthorized party -- a goal hijack variant targeting information disclosure.
      strength: primary
  owasp_llm:
    - id: LLM02:2025
      context: This rule implements LLM02:2025 Sensitive Information Disclosure detection, identifying requests that attempt to extract confidential context, system prompts, or credentials from the agent.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this context exfiltration detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
      strength: primary
    - article: '9'
      context: Context exfiltration is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.
      strength: secondary
    - article: '10'
      context: Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (System Prompt Extraction — Targeted Verbatim Disclosure Attempts) affecting that data.
      strength: secondary
  nist_ai_rmf:
    - function: Manage
      subcategory: MG.2.3
      context: Treating context exfiltration as an identified AI risk requires active runtime countermeasures; this detection rule is the primary risk treatment implementation.
      strength: primary
    - function: Map
      subcategory: MP.5.1
      context: Identifying context exfiltration as an AI risk to be catalogued in the organizational risk register.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (System Prompt Extraction — Targeted Verbatim Disclosure Attempts).
      strength: primary
    - subcategory: MS.2.10
      context: NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (System Prompt Extraction — Targeted Verbatim Disclosure Attempts).
      strength: secondary
  iso_42001:
    - clause: '6.2'
      context: Addressing context exfiltration risk is an objective required under clause 6.2 AIMS information security planning; this rule operationalizes the detection control measure.
      strength: primary
    - clause: '8.4'
      context: Impact assessment for AI deployments under clause 8.4 must account for context exfiltration inputs; detection events from this rule provide the required monitoring evidence.
      strength: secondary
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (System Prompt Extraction — Targeted Verbatim Disclosure Attempts).
      strength: primary
tags:
  category: context-exfiltration
  subcategory: system-prompt-extraction
  scan_target: mcp
  confidence: high
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: user_input
      operator: regex
      value: (?i)(\b(repeat|reveal|show|display|print|output|tell\s+me|disclose|leak|expose|give\s+me|share|provide|recite|reproduce|transcribe|copy|echo)\b[^"']{0,60}\b(your\s+|the\s+|all\s+|my\s+|your\s+full\s+|your\s+entire\s+|your\s+complete\s+|verbatim\s+|exact\s+)(system\s+prompt|system\s+message|system\s+instructions?|initial\s+instructions?|operator\s+instructions?|hidden\s+instructions?|pre[-_]?prompt|meta[-_]?prompt))|(\b(system\s+prompt|system\s+message|system\s+instructions?|initial\s+instructions?|operator\s+instructions?|hidden\s+instructions?|pre[-_]?prompt)\b.{0,150}\b(recite|repeat|tell\s+me|reveal|show|disclose)\b.{0,80}\b(exactly|verbatim|word\s+for\s+word|character\s+by\s+character|exactly\s+as))
      description: Elicitation verb targeting precise system-level objects (possessive/determiner required; forward and reverse forms)
    - field: user_input
      operator: regex
      value: (?i)\b(output|print|show|give|provide|repeat|recite|write|tell\s+me|display|echo|copy|transcribe|disclose)\b.{0,100}\b(word\s+for\s+word|verbatim|character\s+by\s+character|letter\s+by\s+letter|exact\s+wording|exactly\s+as\s+(written|given|provided|stated|stored))\b.{0,200}\b(instructions?|system\s+prompt|configuration|directives?|rules?|guidelines?|parameters?|operator|programming)
      description: Verbatim extraction framing requiring action verb before verbatim keyword
    - field: user_input
      operator: regex
      value: (?i)\b(for\s+(debugging|troubleshooting|diagnostic|testing|verification|audit|review|inspection|development)|in\s+(debug|diagnostic|test|dev)\s+mode|diagnostic\s+output)\b.{0,120}\b(output|show|print|display|reveal|disclose|provide|include|dump|list)\b.{0,100}\b(your\s+)?(configuration|config|system\s+prompt|instructions?|parameters?|api\s+keys?|secrets?|directives?|rules?|guidelines?)
      description: Debug/diagnostic framing for system configuration extraction
    - field: user_input
      operator: regex
      value: (?i)\b(repeat|output|print|display|show|echo|reproduce|transcribe|copy)\s+(everything|all\s+(content|text|messages?|instructions?|context)|all\s+of\s+the\s+(above|previous)|the\s+above)\b.{0,120}\b(above|before\s+this|prior\s+to\s+this|including\s+the\s+system|including\s+(any\s+)?hidden|above\s+this\s+(conversation|message|line|prompt))
      description: Repeat-everything-above extraction targeting system context
    - field: user_input
      operator: regex
      value: (?i)\b(begin|start|open|prefix|preface)\s+(your\s+)?(response|answer|reply|message|output)\s+with\s*[:\-]?\s*['"]?(my\s+system\s+(prompt|instructions?|config)|my\s+instructions?\s+(are|read|say|state)|i\s+was\s+(instructed|told|configured|programmed)|i\s+am\s+(configured|programmed|instructed))
      description: Response-priming forced disclosure attack
    - field: user_input
      operator: regex
      value: (?i)\b(what\s+(did|were)\s+the\s+(operators?|admins?|anthropic|openai|google|developers?|company|organization|system)\s+(tell|instruct|give|provide|configure|program)\s+(you|to\s+you)|what\s+instructions?\s+(did|were)\s+(the\s+)?operators?\s+give\s+you|repeat\s+(what|it|that)\s+back.{0,30}(operator|system|hidden|verbatim|character))
      description: Operator instruction extraction and character-by-character extraction
    - field: user_input
      operator: regex
      value: (?i)\b(ignore\s+(confidentiality|your\s+(nda|rules?|guidelines?|instructions?|restrictions?))\.?\s*(your|the)\s+(system\s+prompt|instructions?)|your\s+(system\s+prompt|initial\s+instructions?|configuration)\s+(is|are|reads?|states?|says?)\s*[:\[_\(].{0,50}(complete|fill|continue|finish|answer))
      description: Completion attack against system prompt extraction
  condition: any
  false_positives:
    - 'Capability inquiry: ''What are your main capabilities?'''
    - 'Educational questions: ''What is a system prompt in the context of AI?'''
    - 'Authoring help: ''How do I write a good system prompt for my chatbot?'''
    - 'Document summarization: ''Please summarize the document I provided'''
    - 'Content repetition from user-provided material: ''Repeat the last paragraph of the article I shared'''
response:
  actions:
    - block_input
    - alert
    - snapshot
    - escalate
  auto_response_threshold: high
  message_template: |
    [ATR-2026-00514] HIGH: System prompt extraction attempt detected. Input contains patterns consistent with elicitation of system-level instructions or operator configuration. Request blocked and logged for review.
confidence: 82