inject "sure, here is how to do it" and 11 ai models will finish the sentence

Trend Micro named it sockpuppeting: stuff one line — "Sure, here is how to do it" — into the assistant role before the safety check fires. The model, trained to maintain self-consistency, reads its own fake compliance and keeps going. Per Trend Micro’s research, Gemini 2.5 Flash was the most susceptible model tested at a 15.7% attack success rate. No weight changes, no optimization loop. One injected role message.

OpenAI and AWS Bedrock are immune — but not because their models are safer. They block assistant prefill entirely, which means they also removed a legitimate developer feature that API users rely on for structured output formatting. It’s a product restriction doing the work of a safety layer, dressed up as a security posture.

Google Vertex AI accepts prefills for certain models and relies on the model’s internal training to hold the line. Based on Gemini 2.5 Flash’s numbers, that’s not going great.

The real exposure is self-hosted inference. Ollama and vLLM don’t validate message ordering by default. If you’re running a model locally — for privacy or to cut costs — your inference server probably accepts any role in any order. The fix is an API-layer validator; it ships off by default and most setup guides skip it.

The Trend Micro researchers trace the vulnerability to self-consistency training: models read an injected prefix as their own prior output and treat contradiction as broken behavior. Every model trained this way carries the same structural exposure — the split isn’t between safe and unsafe models, it’s between API providers who killed prefill for everyone and self-hosted setups where nobody flipped the switch.

Check your inference server config before you check the model benchmarks.