Completion bias is the tendency of a language model to continue a coherent pattern once it has started, even when the continuation is unsafe or inappropriate. Attackers exploit this behavior by wrapping harmful requests in riddle-like or narrative structures. The model then prioritizes sequence completion over policy awareness.
How completion bias works
Completion bias is a model behaviour, not a single vulnerability class. It appears when a language model treats a partially started sequence as something to finish, even if the safest answer would be to stop, refuse, or change direction. The result is often overcommitment to the pattern already in motion.
This matters because the model’s next-token preference can outrank the broader intent of the prompt. In practice, the more coherent and immersive the attacker’s setup, the easier it can be for the model to stay inside the malicious frame rather than re-evaluate the request from first principles.
Why attackers use narrative framing
Attackers exploit completion bias by hiding harmful instructions inside stories, riddles, code-like blocks, roleplay, or other structured formats that encourage continuation. The payload is not always obvious at the start; it is often revealed gradually, which increases the chance that the model keeps following the thread instead of breaking it.
This tactic is effective because it borrows the model’s strength, pattern continuation, and turns it into a weakness. A request that appears playful, indirect, or incomplete can still be steering the model toward disallowed output, particularly when the harmful objective is embedded as the “obvious next step”.
Why completion bias is dangerous
Completion bias is dangerous because it can create unsafe consistency, where the model preserves tone, structure, and momentum even after the content has crossed a policy boundary. That can produce persuasive but harmful instructions, extended disallowed content, or answers that look polished precisely because the model stayed locked into the attacker’s frame.
It also weakens a common defensive assumption: that a model will naturally interrupt a bad request when the prompt becomes suspicious. Instead, the model may behave as though finishing the pattern is more important than re-evaluating the risk of what it is about to say.
Where it shows up in model interaction
Completion bias often appears in multi-turn conversations, long-context prompts, and prompts that mimic harmless formats. It can also surface when a model is asked to “continue”, “complete”, “finish the sequence”, or “solve the puzzle”, because those cues are aligned with the model’s native completion objective.
Defensively, this means the issue is not limited to obvious jailbreaks. Any prompt that uses structure to pull the model forward, while hiding the true intent until later in the sequence, can increase the chance of biased continuation.
Risk and Threat Considerations
Completion bias increases the chance that a model will follow an attacker’s framing past the point where a human reviewer would stop. That can turn a seemingly benign interaction into a policy bypass, especially when the harmful intent is delayed until the model is already committed to the pattern.
Failure mechanism: The attacker uses narrative momentum, partial structures, or puzzle-like framing to keep the model predicting the next token within the malicious context rather than re-assessing the request against safety rules.
Impact: The model may generate unsafe instructions, assist abuse, or reveal harmful content while appearing internally coherent and therefore more credible to the user.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST AI RMF and NIST AI 600-1 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1036 — Masquerading | Narrative and format abuse can disguise harmful intent within benign-looking structure. |
| Recommendation — Detect disguised prompt structures that mask malicious objectives and route them for review. | ||
| NIST AI RMF | GV.2 — AI Governance | Completion bias is an AI risk that needs governance over model behavior and misuse. |
| Recommendation — Set governance to review and mitigate model behaviors that enable unsafe continuation. | ||
| NIST AI 600-1 | GV.2 — Govern | The profile addresses GenAI misuse patterns and the need for controlled deployment. |
| Recommendation — Apply governance controls that address prompt-based misuse and unsafe model outputs. | ||
| OWASP Agentic AI Top 10 | ASI01 — Agent Goal Hijack | Attacker framing can steer model/agent outputs away from the safe objective. |
| ASI09 — Human-Agent Trust Exploitation | Completion bias can make polished but unsafe outputs seem trustworthy. | |
| Recommendation — Validate that user framing cannot override the intended safe goal. Challenge outputs that appear coherent but may be shaped by adversarial framing. | ||
Practitioner Guidance
What to watch for: Treat unusually persistent continuation cues as a warning sign, especially when a prompt asks the model to “just keep going” through a story, encoded sequence, or staged reveal. The key judgement is not whether the prompt looks creative, but whether it is steering the model into staying with a pattern that should have been broken.
Practitioner takeaway: Strong controls do not just block explicit bad requests, they also interrupt the model’s momentum when the structure itself is being used as the attack path.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org