AIF-C01 Practice Question 46: Obfuscated Prompt Attack
AWS Certified AI Practitioner (AIF-C01) · Test 5 · question 6 of 10
A company's chatbot has an input filter that blocks messages containing phrases such as "ignore your instructions". An attacker gets around it by sending the malicious instruction encoded in base64, which the filter can't read but the model decodes and follows. According to AWS guidance on common prompt attacks, which type of attack is this?
Show answer and explanation
Answer:
In a changing the input attack format attack, the attacker writes malicious instructions in a different, sometimes non-human-readable format, such as base64 encoding, specifically to avoid application input filters that would otherwise stop the model from ingesting them. That is exactly what happened here: the filter couldn't recognize the encoded text, but the model could (option C). Defenses combine several guardrails, because some attacks are chained together.
- A is wrong because extracting the prompt template means asking the model to *print its instructions*. That exposes the template to later attacks, but this attacker is disguising an instruction, not requesting the template. - B is wrong because fake completion supplies *pre-completed answers* (prefilling) that steer the model away from its instructions. It isn't about encoding text to evade filters. - D is wrong because extracting conversation history asks the model to reveal earlier conversation, which might contain sensitive information. The attack here is about getting past the filter.
Reference: Common prompt injection attacks