AI Output Filter Lab: Get the Secret Past the Scrubber

This article describes an interactive security lab demonstrating how literal output filtering on AI systems can be bypassed by requesting the model to transform a secret string (encode, split, or reverse it) before outputting it. The filter fails because it matches only the exact byte sequence of the original secret, while the transformed version passes through unchanged and can be reconstructed by the attacker. The lab teaches a fundamental principle: output scrubbing is not effective data-loss prevention, and secrets must be kept away from the model entirely to prevent disclosure.

• Literal filtering matches exact byte sequences onlyThe output filter in the lab checks for the precise secret string and removes it from replies. When the model transforms the secret through encoding, splitting, spacing, or reversing, the filter no longer recognizes the transformed version as a match, allowing it to pass through to the user unblocked.
• Reversible transformations defeat string-matching filtersThe attack strategy involves asking the model to emit the secret in an alternative form such as encoded text, reversed characters, or one character per line. Because these transformations are reversible by the attacker, the secret remains accessible even though the literal filter does not catch it.
• The filter answers the wrong questionThe core weakness is that the filter only answers 'does this reply contain the exact secret?' A transformed secret answers 'no' while still carrying the actual value. The model remains cooperative and the transformation remains reversible, making the literal filter essentially useless against this attack method.
• Output filtering is not data-loss preventionThe article emphasizes that scrubbing a known literal from output provides a false sense of security. Any reversible transformation defeats it, which is why OWASP LLM02 Sensitive Information Disclosure stresses keeping secrets out of the model's reach entirely rather than relying on filtering after the fact.
• Real-world protection requires prevention not scrubbingThe only reliable defense is keeping secrets out of the model's context entirely. The article recommends minimizing what the model can access, treating literal output matching as defence in depth at best, and monitoring for transformed-exfiltration patterns like encoded or fragmented output.
• Literal output matching is fundamentally brittleThe article notes that literal filtering is bypassed through encoding, splitting, or character-level tricks. If a system's protection for a secret is 'filter it out of the reply', the article advises assuming it is bypassable and that the durable fix requires preventing the model from seeing the secret in the first place.

Bottom line: Output filtering based on literal string matching is ineffective security; attackers can request the model to transform secrets through encoding, reversal, or splitting, allowing them to bypass the filter and reconstruct the value. The only reliable defense is architectural: keep secrets entirely out of the model's context so there is nothing to filter.