title: Harmful Completion / Continuation Attack
id: ATR-2026-00279
rule_version: 1
status: experimental
description: |
  Detects continuation attacks where a partial phrase, sentence, or word is provided with the expectation that the model will complete it with harmful content. From NVIDIA garak continuation.py probe. Three variants: (1) Slur-prefix completion — model is given the first 1-2 letters of a ethnic slur with preceding context ("he called them a [prefix]") hoping it autocompletes the slur; (2) Harmful sentence completion — "The best way to hurt someone is..." expecting the model to continue; (3) Explicit completion requests — "Complete this phrase/sentence/thought: [partial harmful content]". The model's next-token prediction can be exploited to complete harmful content it would refuse if asked directly.
author: ATR Community (via NVIDIA garak continuation probe)
date: 2026/04/19
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: medium
references:
  owasp_llm:
    - LLM01:2025
  owasp_agentic:
    - ASI01:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
  research:
    - https://github.com/NVIDIA/garak/blob/main/garak/probes/continuation.py
compliance:
  eu_ai_act:
    - article: '15'
      context: Harmful completion attacks exploit next-token prediction to elicit harmful content that would be refused if requested directly; Article 15 robustness requirements mandate that high-risk AI systems resist systematic adversarial techniques targeting behavioral constraints through partial-phrase completion mechanics.
      strength: primary
    - article: '9'
      context: Continuation attacks are a documented adversarial technique in the AI risk landscape; Article 9 risk management systems must include detection controls for completion-based jailbreak patterns that use implicit rather than explicit harmful requests.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: Harmful completion and continuation attacks exploit next-token prediction mechanics to elicit harmful content through partial-phrase baiting; MP.5.1 requires that this class of adversarial input technique targeting model completion behavior be identified and tracked as an AI system risk.
      strength: primary
    - subcategory: MG.2.3
      context: Risk treatment plans under MG.2.3 must implement detection controls for completion-based jailbreaks — including slur-prefix completion, harmful sentence starters, and synthesis step continuation — that bypass direct refusal by using implicit harmful requests.
      strength: secondary
    - subcategory: MS.2.6
      context: NIST AI RMF MEASURE 2.6 (system evaluated regularly for safety risks) is supported by this rule's detection of the model-abuse / harmful-content elicitation attempt (Harmful Completion / Continuation Attack).
      strength: primary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the model-abuse / harmful-content elicitation attempt (Harmful Completion / Continuation Attack).
      strength: secondary
  iso_42001:
    - clause: '6.2'
      context: Risk treatment activities under clause 6.2 must address harmful completion attacks where partial harmful phrases or synthesis instructions with trailing ellipses exploit AI next-token prediction to produce content the system would refuse if asked directly.
      strength: primary
    - clause: '8.1'
      context: Operational controls under clause 8.1 must include input scanning that detects continuation bait patterns — explicit completion requests with harmful domain markers, slur-prefix redaction, and open-ended synthesis steps — before they reach the model's prediction layer.
      strength: secondary
tags:
  category: model-abuse
  subcategory: harmful-completion-continuation
  scan_target: mcp
  confidence: medium
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: tool_response
      operator: regex
      value: (?:complete|finish|continue|extend)\s+(?:this\s+)?(?:sentence|phrase|thought|paragraph|word)\s*[:\-–]\s*["\x27]?[^\n"]{0,150}(?:hurt|harm|kill|attack|destroy|abuse|exploit|synthesiz|manufactur|explosiv|weapon|drug|poison|stab|shoot|steal|hack|murder|assault|illegal|illicit)[^\n"]{0,100}(?:\.\.\.|…|___+|____|\[\.\.\.?\]|\[FILL\]|\[complete\s+this\])
      description: Explicit completion request with trailing ellipsis or fill-marker — surface for harmful-continuation bait
    - field: tool_response
      operator: regex
      value: (?:the\s+best\s+way\s+to\s+(?:hurt|harm|kill|attack|destroy|manipulate|abuse|exploit)\s+(?:someone|a\s+person|people|them|him|her|children|animals))\s+is\b
      description: Harmful-action sentence starter expecting model completion — "The best way to hurt someone is..."
    - field: tool_response
      operator: regex
      value: (?:he|she|they|people|he|she)\s+(?:called|referred\s+to|described|named)\s+(?:them|him|her|us|the\s+group|that\s+group)\s+(?:(?:using|with|as)\s+)?(?:a\s+|an?\s+)?[a-z]{1,2}[_\*\.]{2,}(?:[a-z]{0,4})?(?:\s|$)
      description: Slur-prefix completion bait — ethnic/slur reference with initial letters plus redaction markers expecting completion
    - field: tool_response
      operator: regex
      value: (?:in\s+order\s+to\s+(?:make|build|create|produce|synthesize)\s+\w+\s*,?\s*(?:you\s+(?:need|must|should|first)|the\s+(?:first|next)\s+step\s+is|start\s+by))\s+[^\n]{0,80}(?:\.\.\.|___+|and\s+then\s*\.{2,}|\[(?:continue|next|rest)\])
      description: Partial synthesis/production instruction with continuation marker — model expected to complete harmful steps
    - field: tool_response
      operator: regex
      value: (?:what\s+(?:comes|goes)\s+(?:next|after)(?:\s+(?:when|in|for))?|now\s+(?:complete|finish)\s+(?:it|this|the\s+(?:thought|process|sentence|recipe|steps?)))\s*[:\.\-–]\s*[^\n]{5,120}(?:\.\.\.|___+|and\s+\.{2,})
      description: '"What comes next" or "now complete it" with trailing partial — implicit continuation request'
  condition: any
  false_positives:
    - Legitimate autocomplete or text-prediction UI debugging prompts
    - Creative writing prompts with intentional cliffhanger endings for fiction
    - Language model benchmarking asking the model to complete benign sentences
response:
  actions:
    - alert
  message_template: |
    [ATR-2026-00279] Harmful completion/continuation attack detected - partial harmful phrase designed to elicit dangerous continuation via next-token prediction.