ORBiS TREE · ENGLISH DOCUMENT
Concepts →Prompt Injection
How input-borne instructions can redirect AI systems, with distinctions between evidence, authority, attack outcomes and task success.
한국어
English
This English page is a curated translation layer linked to the Korean source article. Community changes are currently made on the Korean source, where the full revision history and anonymous edit trail are preserved.
Overview
Prompt injection attempts to redirect an AI system through material it processes. Direct inputs and indirect content from websites, files or tool results create different entry paths. OWASP's taxonomy ↗ describes this distinction; consequences depend on the system's actual permissions.[1]
The boundary between evidence and instructions
Material retrieved by RAG can support an answer without authorizing an action. Treating an external sentence as an instruction above the user's goal can redirect a reading task into an unrelated write. Greshake and colleagues ↗ examine instructions planted in retrievable material.[2] Their threat model is not a vulnerability verdict for every current product.
Fictional case: reviewing sources for an AI wiki
This is an ORBiS Tree teaching scenario. The task is to read official material and prepare an article change; publication is outside scope. A source sentence requesting publication without review does not grant that permission. Retain the original request, source, proposed change and observed storage result separately.
An incorrect summary, an unsupported claim and obedience to hostile instructions can have different causes. A wrong answer alone does not establish a successful attack; inspect the input path and actual action.
Check the execution layer too
OWASP's mitigations ↗ include least privilege, distinguishing outside material and reviewing consequential actions.[1] The following operational proposal is ORBiS Tree's application of those ideas.
- Separate read and write permissions.
- Validate allowed targets, operations and arguments in execution code.
- Do not interpret outside content as permission to expand the task.
- Compare resulting state and record failures or duplicate execution.
One text filter or warning is not a complete defense. Continue to AI Agent Oversight for review points and evidence of outcomes.
Worked example: attack and task success denominators
In a fictional 40-run injection experiment, four unauthorized actions give an all-run attack success proportion of 4/40=10%. If 28 of the same 40 runs correctly complete the original task, task success is 28/40=70%. Do not combine these outcomes into one safety score. These are teaching counts, not measurements of a product.
Scope of research evidence
InjecAgent ↗ evaluates indirect injection in tool-integrated agents.[3] Read its evaluation design in section 2 with its limitations in section 8. Results for fixed tools, attacks and models do not establish a present service-wide risk probability. Screens and repository material also become input paths in Computer Use and Agentic Coding.
SOURCES
Sources
-
LLM01:2025 Prompt InjectionOWASP Gen AI Security ProjectOpen source ↗
-
Not what you have signed up for: Indirect Prompt InjectionGreshake et al.Open source ↗
-
InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated LLM AgentsZhan et al. / Findings of ACL 2024Open source ↗
KNOWLEDGE LINKS
Continue from here
BACKLINKS