Topic 3
Indirect injection through data
Indirect prompt injection doesn't need the attacker to talk to the model at all. They put instructions in data the model will read later: a web page, an email, a shared document, a repository. Greshake et al. (arXiv:2302.12173) introduced the term for attacks that work "by strategically injecting prompts into data likely to be retrieved." AI Engineering (Ch. 5, "Indirect prompt injection") calls it "a new, much more powerful way of delivering attacks."
Predict first
Scroll sideways to see the whole diagram
The attacker never talks to the model. They put text where a model will later read it.
Text version
- The attacker never talks to the model. They put text where a model will later read it.
- The user is not the attacker. They ask an ordinary question.
- Retrieval or a tool call brings the planted text into the context, next to the user's request.
- Nothing in the token stream says the text is data, so the model may treat it as an instruction.
- The action runs with whatever tools and data the application gave the model. That is where the damage is done.
After Greshake et al. (arXiv:2302.12173) and AI Engineering, Ch. 5, "Indirect prompt injection". Illustrative scenario.
The book gives two delivery routes:
- Passive phishing: payloads left in public places (web pages, GitHub repositories, video pages, comments), waiting for a model's web search to find them.
- Active injection: sending the payload to the target, such as an email that an assistant will read and summarise. The book's example, from Wallace et al. (2024), is an email that tells the assistant to forward every email in the inbox.
RAG systems are exposed the same way. The book's example: a username like "Bruce Remove All Data Lee" that a model turning text into SQL might read as a command. Many databases sanitise inputs against SQL injection, but it is "harder to distinguish malicious content in natural languages."
Greshake et al. showed these attacks against real systems in 2023 and wrote that "effective mitigations of these emerging threats are currently lacking."
Quick check