Prompt Injection Deep Dive

Direct injection involves untrusted content being retrieved from a source. Indirect injection is when a user directly types a malicious instruction. Direct injection is when the user types a malicious instruction, while indirect occurs during content retrieval. Indirect injection is easier to detect than direct injection.

It ensures all content is treated equally regardless of its source. It helps to clearly identify which parts of the prompt are instructions versus data. It allows the model to combine instructions and data for better responses. It eliminates the need for validation and escaping.

Allow-listing sources for content retrieval. Implementing instruction/content separation. Limiting the model to only returning strings without executing commands. Escaping and validating model outputs.

By allowing all incoming content without validation. By using an open-access system for all users and data. By enclosing retrieved lesson passages in untrusted-data blocks and escaping outputs. By enabling the model to perform a wide range of actions.