Your template placeholder, typed in
The placeholder your own templating uses to mark where a document gets dropped in, written into the document so a model reads a second, attacker-supplied document beginning.
How the text is hidden
Software that feeds documents to a model usually substitutes the extracted text into a template at a named placeholder. Guess that placeholder and write it into the file, and the assembled prompt contains what looks like a second substitution point — the real document appearing to end and a fresh one to begin. Nothing is hidden; the string is ordinary visible text. The shipped pack entry matches {{DOCUMENT_TEXT}} case-insensitively with optional whitespace inside the braces. The specification marks this pattern caller-specific, and it lives in rule-pack data precisely so a deployment can register the sentinels its own templating uses instead of inheriting the default one.
Why a model still reads it
Extraction preserves it because it is real document text, and the templating step that would normally consume such a string has already run. What reaches the model is a boundary token in a position your template never put one.
What we do about it
Matched in the same structural-marker pass as the other two: over assembled canonical text, after family-C codepoint stripping, with the pattern, flags and replacement all read from the pack. A hit is replaced with the visible token [ scrubbed-prompt-marker ] rather than removed, and reported as family: "marker", severity: "informational", action: "marked" — no verdict change, summary.certified withdrawn. The rule pack loader rejects any structural marker entry that has no replacement, so a marker can never be registered as a silent deletion.
How often it fires
Not measured. We publish a rate only where one has been measured against a named corpus of the right format, and no figure exists for this technique yet. Absence means unknown — never low.
Check your own file
Three commands: a key, credit, a verdict.
Start with the API