6 ms·

> There is no single control that solves indirect prompt injection There is, actually. It's called removing the AI agent. Done.

cryo32 3mo ago
This is the methodology I use. No determinism, no separation of data and instructions, centrally controlled. What couldn’t go wrong?
- dyauspitr 3mo ago
  [flagged]
  - eli 3mo ago
    So it can write code to prevent the problem described?
    - dyauspitr 3mo ago
      [flagged]
      - customguy 3mo ago
        What kind of "standard inbuilt anti injection code" are you referring to? Mysql_real_escape_string()?
        vntok 3mo ago
        Look up "prepared statements", it's pretty well documented.
      - troupo 3mo ago
        How does this prevent prompt injection described in the article? How does it prevent DDOSing and/or exposing the database from an injected prompt?
        Dylan16807 3mo ago
        The user asks for details of the last transaction, the user gets back the amount, the source, and the description in a safely quoted format with the LLM never reading it. You can't inject the LLM if it doesn't see the data. An architecture like this won't work in many situations, but it can work for a lot of simple questions. And if you want the LLM to summarize things, you run an isolated instance that makes a summary and you never show that summary to the LLM that's following the user's instructions.
        troupo 3mo ago
        > The user asks for details of the last transaction, the user gets back the amount, the source, and the description in a safely quoted format What's "safely quoted format" when prompt injection is already safe in the description? > You can't inject the LLM if it doesn't see the data. How doesn't it see the data when you literally say "The user asks for details of the last transaction, the user gets back the amount, the source, and the description"? > And if you want the LLM to summarize things, you run an isolated instance that makes a summary And it will make a summary exactly how?
        Dylan16807 3mo ago
        > How doesn't it see the data when you literally say "The user asks for details of the last transaction, the user gets back the amount, the source, and the description"? The above post said how. The LLM writes code to do it. The code has a function to send text to the user. The LLM is not allowed to see the text, only the user is. > And it will make a summary exactly how? The second summarizing-only LLM is fed the raw data and allowed to output summary text. This is then sent directly to the user and put in a box with some hazard lines on it. The main LLM is not allowed to see the summary, only the user is.
        troupo 3mo ago
        Ah. Now I see you point. This might actually work for a number of situations.

cryo32 3mo ago

This is the methodology I use. No determinism, no separation of data and instructions, centrally controlled. What couldn’t go wrong?

dyauspitr 3mo ago
[flagged]
- eli 3mo ago
  So it can write code to prevent the problem described?
  - dyauspitr 3mo ago
    [flagged]
    - customguy 3mo ago
      What kind of "standard inbuilt anti injection code" are you referring to? Mysql_real_escape_string()?
      - vntok 3mo ago
        Look up "prepared statements", it's pretty well documented.
    - troupo 3mo ago
      How does this prevent prompt injection described in the article? How does it prevent DDOSing and/or exposing the database from an injected prompt?
      - Dylan16807 3mo ago
        The user asks for details of the last transaction, the user gets back the amount, the source, and the description in a safely quoted format with the LLM never reading it. You can't inject the LLM if it doesn't see the data. An architecture like this won't work in many situations, but it can work for a lot of simple questions. And if you want the LLM to summarize things, you run an isolated instance that makes a summary and you never show that summary to the LLM that's following the user's instructions.
        troupo 3mo ago
        > The user asks for details of the last transaction, the user gets back the amount, the source, and the description in a safely quoted format What's "safely quoted format" when prompt injection is already safe in the description? > You can't inject the LLM if it doesn't see the data. How doesn't it see the data when you literally say "The user asks for details of the last transaction, the user gets back the amount, the source, and the description"? > And if you want the LLM to summarize things, you run an isolated instance that makes a summary And it will make a summary exactly how?
        Dylan16807 3mo ago
        > How doesn't it see the data when you literally say "The user asks for details of the last transaction, the user gets back the amount, the source, and the description"? The above post said how. The LLM writes code to do it. The code has a function to send text to the user. The LLM is not allowed to see the text, only the user is. > And it will make a summary exactly how? The second summarizing-only LLM is fed the raw data and allowed to output summary text. This is then sent directly to the user and put in a box with some hazard lines on it. The main LLM is not allowed to see the summary, only the user is.
        troupo 3mo ago
        Ah. Now I see you point. This might actually work for a number of situations.