Prompt injection

Definition

Prompt injection is input crafted so that the model treats attacker-supplied text as instructions rather than as data. In the direct form the attacker is the user (or controls the user turn) and writes the instruction into the prompt: override the system prompt, ignore prior rules, adopt a new persona, reveal the hidden instructions, or call a tool the task never required.

It works because a language model has no privileged channel: system text, user text and quoted content arrive as one token stream, and the model's obedience is a statistical tendency, not an access control. That makes injection an input validation problem that cannot be closed by input validation alone; the durable controls sit around the model: what it is allowed to do, what it is allowed to see, and what is observed.

How it manifests

• Override phrasing in a user turn: “ignore all previous instructions”, “you are now…”, “developer mode”, “print your system prompt”.
• Delimiter and format games: fake end-of-system markers, JSON or XML that imitates the application's own framing, instructions hidden in code blocks.
• A scanner or guardrail verdict on the received prompt (prompt.scanned, guardrail.triggered) that classifies the turn as injection.
• Behavioural change downstream: the model proposes a tool outside the task, or its answer leaks configuration it should not have.

How AsrielNetworks detects it

The direct rule consumes the events a runtime emits when a prompt arrives and is scanned. It fires on a structured injection verdict from the scanner, and on deterministic instruction-override signals in the prompt event itself; it does not need the raw prompt text when the runtime redacts it, because the structured signals travel with the event.

• Direct prompt injectionai.prompt_injection.direct · high
  Structured injection verdicts and deterministic instruction-override signals in received or scanned prompts.

References