Indirect Prompt Injection
Retrieved pages can contain instructions to ignore policy or reveal private records. Treat retrieved text as untrusted evidence, not application instructions. Delimiters help but are not complete defenses. Strong controls include least-privilege tools, scoped data access, minimized secrets in context, argument validation, network restrictions, and approval for sensitive actions.
Test hostile documents that attempt to reveal prompts, cross tenants, or trigger tools. The model should not gain new permissions from a document.
Implementation example
const allowedTools = new Map([
["searchKnowledgeBase", searchKnowledgeBase],
["getCurrentUserProfile", getCurrentUserProfile]
]);
async function executeTool(name,args,ctx) {
const tool=allowedTools.get(name);
if(!tool) throw new Error("Tool not allowed");
return tool(args,ctx);
}💡 An allowlist limits available functions, but each tool must also validate arguments and authorize access.
Key Takeaways
- Inspect the relevant pipeline stage instead of guessing.
- Preserve source provenance, versions, and access scope.
- Measure quality on representative queries.
Knowledge Check
What is a strong defense against injected cross-tenant access?