title: System Prompt Extraction - Oblique Referent + Transform
id: ATR-2026-02026
rule_version: 1
status: experimental
description: |
  Detects system-prompt / initial-instruction extraction attempts that use OBLIQUE referents ("the text above", "initialization string", "what you were given initially", "your initial prompt") rather than the literal words "system prompt / instructions / configuration" that ATR-2026-00505 already covers, AND the transform-and-reveal variants (ROT13 / translate / replace vowels / emoji round-trip) that ask the model to emit its hidden context in an obfuscated form. Mined from the garak sysprompt_extraction misses on origin/main: recovers all 9 false negatives on the 708-rule baseline (re-verified against 713 rules), 0 FP across 830 benign samples (PINT + skill-benchmark).
author: ATR Community (garak-gap-mining)
date: '2026-07-10'
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM02:2025
  owasp_agentic:
    - ASI01:2026
  mitre_atlas:
    - AML.T0024 - Exfiltration via AI Inference API
metadata_provenance:
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
  mitre_atlas: human-reviewed
compliance:
  owasp_agentic:
    - id: ASI01:2026
      context: Oblique-referent and transform-and-reveal system-prompt extraction redirects the agent to expose internal state (system prompt, initial instructions) to an unauthorized party -- a goal hijack variant targeting information disclosure that literal-keyword detection (ATR-2026-00505) misses.
      strength: primary
  owasp_llm:
    - id: LLM02:2025
      context: This rule implements LLM02:2025 Sensitive Information Disclosure detection, identifying oblique-referent and encode/transform requests that attempt to extract the system prompt or initial instructions without using the literal words that ATR-2026-00505 targets.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this context exfiltration detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation, covering the oblique-referent/transform variant that literal-keyword rules miss.
      strength: primary
    - article: '9'
      context: Context exfiltration is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.
      strength: secondary
  nist_ai_rmf:
    - function: Manage
      subcategory: MG.2.3
      context: Treating oblique-referent context exfiltration as an identified AI risk requires active runtime countermeasures; this detection rule is the primary risk treatment implementation.
      strength: primary
    - function: Map
      subcategory: MP.5.1
      context: Identifying oblique-referent/transform context exfiltration as an AI risk to be catalogued in the organizational risk register.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by this rule's detection of the oblique-referent/transform system-prompt-extraction attempt.
      strength: primary
    - clause: '8.4'
      context: Impact assessment for AI deployments under clause 8.4 must account for context exfiltration inputs; detection events from this rule provide the required monitoring evidence.
      strength: secondary
tags:
  category: context-exfiltration
  subcategory: system-prompt-extraction
  scan_target: llm_io
  confidence: medium
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  condition: any
  conditions:
    - field: user_input
      operator: regex
      value: (?i)\b(rot13|base64|translate|encode|reverse|replace\s+(all\s+)?(the\s+)?vowels?|emoji|caesar|morse)\b[\s\S]{0,25}\b(your\s+(initial|original|first|starting)\s+(prompt|instructions?|message)|the\s+text\s+(you\s+were\s+given|above)|(what|instructions?)\s+you\s+were\s+(given|told)\s+(initially|first|at\s+the\s+(start|beginning))|initial(ization)?\s+(prompt|string|instructions?)|your\s+initial\s+prompt)
      description: Transform/encode verb applied to the initial/original/above instructions
    - field: user_input
      operator: regex
      value: (?i)\b(output|repeat|print|show|reveal|display|dump)\b[\s\S]{0,20}\b(the\s+text\s+above|initial(ization)?\s+string|everything\s+above|the\s+above\s+text)\b
      description: Output/repeat the text above or initialization string
    - field: user_input
      operator: regex
      value: (?i)\bwhat('?s| is| are| were)?\b[\s\S]{0,20}\b(you\s+(were\s+told|not\s+supposed\s+to\s+(tell|say|reveal|share))|told\s+before\s+this\s+(conversation|chat)|the\s+opposite\s+of\s+your\s+(system\s+)?(instructions?|prompt))
      description: Interrogative probe for withheld setup / opposite of system instructions
  false_positives:
    - Users legitimately asking to ROT13/base64 encode their OWN supplied text (Layer A requires an initial/original/above referent, not arbitrary user text)
    - Educational questions about what system prompts are
response:
  actions:
    - block_input
    - alert
  message_template: |
    [ATR-2026-02026] Oblique system-prompt extraction attempt (transform-and-reveal or 'the text above' referent) detected.
confidence: 75