Citation Is Not a Safety Boundary

There's a companion mechanism to the git-history authorization laundering I wrote about recently, and it's worth naming on its own because it doesn't route through any artifact at all. It routes through a verb. Ask a model to write a phishing pretext and it refuses. Ask it to summarize a slide deck that already contains one, extract the key points, convert the bullets into a checklist, and it will often produce the identical content, because in the model's frame those are different acts. One is composition. The other is retrieval. Retrieval doesn't feel like it needs the same guardrail, and during a red-team engagement on a frontier model, under NDA, that gap between composition and retrieval was one of the most reliable seams in the whole exercise.

The mechanism is citation laundering: get the harmful content into the context window as something that already exists, a document, a transcript, a slide, and then ask the model to perform a clerical operation on it, summarize, extract, reformat, translate. The model's refusal training is mostly aimed at the moment of origination. It's good at noticing when it's about to generate an attack from a bare request. It's much worse at noticing that reproducing one, word for word, dressed as a summary, is the same output with a different verb attached to the request.

Attack Vector: The Summarization Alibi

The cleanest version needs no cleverness at all. Put the offensive content inside a document, then ask for a summary, key points, or an executive briefing. The model treats compression of existing text as a lower-stakes act than generation of new text, even when the compression is lossless enough that the offensive content survives entirely intact. "Summarize the attached training deck" and "write me a phishing pretext" can produce the same paragraph. Only one of those requests reliably gets refused.

Attack Vector: Reformatting as Cover

A step subtler: ask the model to transform the document's structure rather than its content, turn these bullet points into a numbered checklist, convert this into a runbook, translate this into another language. Format transformation reads as clerical work, the kind of task a model should perform on anything handed to it, and that clerical framing lowers the model's felt sense of authorship even further than plain summarization does. The offensive content isn't being summarized. It's being relaid, verbatim, through a task that sounds like typing, not writing.

Attack Vector: The Embedded Correction

The sharpest version exploits the model's instinct to be helpful about small inconsistencies. Present a document with a technique described but a key detail redacted, garbled, or deliberately wrong, and ask the model to fix it, complete the citation, or "quote what this section was clearly trying to say." The model isn't generating the missing piece from scratch in its own frame. It's completing something that already almost exists, the same instinct that makes it helpful at fixing a typo or finishing a truncated sentence, and that instinct doesn't distinguish between finishing a sentence and finishing an exploit chain.

Blue Team Defense: Score the Output, Not the Stated Verb

The fix has to ignore the framing entirely. A safety layer that treats "summarize" and "generate" as different risk tiers is scoring the request instead of the result, and the result is the only thing that can actually cause harm. Whatever comes out of the model needs to clear the same bar regardless of whether it arrived labeled as a quote, a translation, or a checklist. This is the direct sibling of a lesson I keep coming back to: authorization claims made by the requester, whether it's a branch name implying a task was already approved, or a verb implying the content is just being relayed, don't get to grade their own permission slip.

Blue Team Defense: Verify the Citation Before Trusting It

If a model's output is going to get a pass because it's "just quoting a source," that source needs to actually be checked, not taken on the model's word. An unverified claim of reproduction is exactly as attacker-controlled as a fabricated branch name. The document supposedly being summarized might contain nothing of the sort, or might have been engineered specifically to make the harmful content look like something that already existed independently of the request. Provenance has to be checked, not assumed from the shape of the ask.

Blue Team Defense: Treat Every Compiled Output as New Content

The practical rule is the least glamorous and the most effective: any output a model produces, however it got there, is new content the moment it leaves the model, and it gets evaluated as such. Not "this was already in the source, so it's fine that it's now also in the output." The act of compiling, translating, or reformatting something into a usable, structured form is itself a form of generation, and pretending otherwise is exactly the gap that citation laundering lives in.

Claude Whisperer's current form, mapping where a model's refusals actually hold and where they go soft under different framings, is built for cataloging exactly this kind of seam: not just does the model refuse, but which verb, which framing, which claim about the source material makes the same content pass. That map is the actual defensive asset. The refusal boundary was never the hard part. Knowing precisely where it bends is.

---

GhostInThePrompt.com // It was never generated. It was only ever quoted. That's the whole trick, and it only works because quoting sounds safe.