Indirect Prompt Injection

Unlike direct injection, the malicious payload arrives from a trusted source—a web page, document, or database the system is designed to retrieve from. The model processes this content with the same privilege level as legitimate data, bypassing input filters that only scrutinize the user's query. This exploits the instructional hierarchy where retrieved content often carries implicit authority.

• Attacker poisons a public website indexed by the system
• Malicious text is invisible to the user but parsed by the model
• System instructions are overridden by the retrieved content

The injected payload remains dormant in the external data source until a retrieval event triggers it. This creates a persistent threat that can affect multiple users over time without requiring the attacker to interact directly with the target system. A single poisoned document in a knowledge base can compromise every session that retrieves it.

• Payload persists independently of user sessions
• One poisoned source can attack multiple victims
• Detection requires auditing the entire data corpus

The attack unfolds in a two-stage process: first, the attacker contaminates a data source; second, the model retrieves and processes that source in response to an innocent user query. This temporal decoupling makes attribution difficult and allows the attacker to target systems they have no direct access to.

• Stage 1: Poison the external data source
• Stage 2: Wait for retrieval by the target system
• The user's query acts as an unwitting trigger

Because the malicious instruction never appears in the user's input, standard input sanitization and prompt injection detection systems are completely blind to the attack. The payload enters through the retrieval pipeline, which is often treated as a trusted internal data flow rather than an attack surface.

• Bypasses user-input validation entirely
• Exploits the gap between retrieval security and prompt security
• Requires defense at the data ingestion layer

Retrieval-Augmented Generation (RAG) systems are uniquely vulnerable because they explicitly combine retrieved external content with system instructions in the model's context window. An attacker who controls any document in the retrieval corpus can inject instructions that compete with or override the system prompt.

• Vector databases become an attack surface
• Embedding similarity can be gamed to ensure retrieval
• Malicious chunks can target specific query patterns

Retrieved content typically operates at a lower privilege level than system instructions, but models often fail to maintain this hierarchy. Injected text can commandeer the model's tools, exfiltrate conversation history, or manipulate outputs by impersonating authoritative system messages.

• Tool calling can be hijacked via retrieved content
• Conversation history may be exposed to external URLs
• Outputs can be manipulated to spread misinformation

A defensive technique that strictly segregates different information sources within a prompt to prevent cross-contamination. Untrusted retrieved content is wrapped in clearly delimited blocks with explicit warnings. The model is instructed to treat content from different sources with different trust levels, preventing an injection in a retrieved document from being interpreted as a system-level command.

A filter applied to a model's output to redact sensitive data, block malicious URLs, or prevent the leakage of system instructions. Unlike input filters that scan user queries, egress guards catch the results of successful indirect injections. If a poisoned document causes the model to output a phishing link or expose internal prompts, the guard strips or blocks the response before it reaches the user.