Skip to content
ML Academy

Introduced on day 53

Indirect prompt injection

An attack in which instructions are planted in content the application retrieves or receives, such as a web page, email or document, so a third party attacks through the data.

In detail

Greshake et al. (2023) showed that LLM-integrated applications can be steered by text in retrieved data, with harms such as data theft and unwanted actions. The user did nothing wrong, so input filtering on the chat box does not help. Defences limit what the model can do after reading untrusted text.