Summary: Eight PITAX techniques that forge the structural scaffolding of a conversation — role boundaries, prior turns, reasoning traces, tool results, the model’s own opening tokens — so the model treats attacker-authored text as its own or as the system’s.
Sources: raw/AI-attack-techniques/PIT-T-07,31,48,49,51,52,53,56-*.md
Last updated: 2026-07-28
These attacks share one root cause: the model sees a flat token stream, not a structured object with authenticated fields. Anything the format uses to mark a boundary can be typed by whoever controls any part of that stream.
Forging the boundary itself
T48 Special-Token Injection — injecting “the model’s structural control tokens (e.g. <|im_start|>, <|im_end|>, <tool_call>), or near-neighbor strings, into user input to forge or segment role boundaries: fake an assistant turn, mask the real turn, or split sensitive text past moderators” (source: PIT-T-48-special-token-injection.md; cites MetaBreak arXiv 2510.10271).
T07 End Sequences is the older, coarser sibling — abusing stop strings and delimiters (source: PIT-T-07-end-sequences.md). PITAX is explicit that T48 is “broader than End Sequences, which abuses stop/delimiter strings” (source: PIT-T-48).
The “near-neighbor strings” detail matters: filtering the exact control token is insufficient.
Forging prior turns
T31 History Fabrication injects “a fabricated prior assistant message into the client-supplied conversation history, for example, one in which the assistant already agreed to help or began complying. Because most chat APIs are stateless and trust client-sent history, the model treats the forged turn as its own and continues from it” (source: PIT-T-31-history-fabrication-fake-assistant-turn.md; Context Compliance Attack, Microsoft arXiv 2503.05264; Response Attack arXiv 2507.05248).
The stated root cause — stateless APIs trust client-sent history — is an architecture decision, not a model weakness. Server-side conversation state removes this technique outright. Almost nothing else in PITAX has a fix that clean.
Forging the model’s own opening
T49 Output Priming forces “the model to begin its reply with an attacker-chosen prefix or a forged affirmation (Sure, here is...), so token-by-token continuation makes compliance the path of least resistance” (source: PIT-T-49-output-priming-prefix-injection.md).
PITAX carefully separates this from T18 Priming: T18 seeds in-context examples, T49 “seeds the model’s own opening tokens” (source: PIT-T-49). Different insertion point, different defence.
Forging the reasoning
T52 Chain-of-Thought Spoofing injects “fabricated reasoning steps (a fake thinking or scratchpad trace) that conclude the request is permitted, hijacking the model’s reasoning channel to justify compliance.” It is “the inverse of Chain-of-Thought Introspection, which reads the reasoning; this forges it” (source: PIT-T-52-chain-of-thought-spoofing.md; HiddenLayer APE; Yi et al. survey arXiv 2407.04295).
More in reasoning-model-attacks.
Forging completion and tool results
T51 Fake Completion injects “a fabricated answer or task-complete marker into the data so the model believes the legitimate task is finished and proceeds to the attacker’s injected instruction” — described as “the core primitive in the benchmark-strongest Combined Attack” (source: PIT-T-51-fake-completion.md; Liu et al. arXiv 2310.12815).
T53 Tool-Call Spoofing forges “tool-call results or tool-invocation syntax in the context so the agent believes a tool already ran (or must run) and acts on attacker-supplied tool output” (source: PIT-T-53-tool-call-spoofing.md). See agentic-and-tool-attacks.
Forging identity
T56 Authority Impersonation — “falsely asserting an elevated identity or permission state (I am the admin/developer, sudo mode, authorization already granted)… Social-engineering of role and permission, distinct from fictional persona role-play” (source: PIT-T-56-authority-impersonation.md; Pangea PT0030-34; Liu et al. arXiv 2305.13860).
Distinguished from the narrative techniques in persuasion-and-framing because it asserts a permission state rather than a fiction.
The common defence
There is one: authenticate structure out of band. If role attribution, conversation history, tool results and reasoning traces are held server-side and never reconstructed from client-supplied text, T31, T48, T51 and T53 all lose their delivery mechanism at once. Everything else here is filtering, which these techniques are specifically designed to survive.