Why it matters

Prefix injection is potent pattern. Understanding shapes defense.

Advertisement

The architecture

Force prefix: 'Sure, here is...'.

Model continues from affirmative start.

Refusal bypassed.

Prefix injectionForce prefix'Sure, here is:'Model continuesaffirmative flowBypasses refusalcontent emittedGCG optimizes for affirmative prefixes; defense: refusal-aware training
Prefix injection.
Advertisement

How it works end to end

Affirmative prefixes short-circuit refusal.

GCG attacks target this.

Refusal-aware training helps.