Adversarial Quote Injection Detection Prompt

This prompt is a defensive testing instrument for security and verification QA teams. Its job is to stress-test a quote-verification pipeline against adversarial injection attacks—specifically, deliberately fabricated quotes embedded in otherwise legitimate content. Use it when you need to answer the question: 'If a bad actor inserts a fake quote into a news article, research brief, or legal filing, will our system flag it?' The prompt is not a general-purpose fact-checker, a content generator, or a tool for verifying ordinary misquotations. It is purpose-built for probing the boundary between authentic content and injected falsehoods.

To use this prompt effectively, you must already have a document containing a suspect quote and enough surrounding context to perform a comparative analysis. The prompt assumes the input includes the full text of the document, the specific quote under suspicion, and any available metadata such as publication date, author, and source provenance. It works by analyzing stylistic anomalies (e.g., a quote that doesn't match the speaker's known vocabulary), provenance gaps (e.g., a quote that appears in no archive), and temporal inconsistencies (e.g., a quote referencing events that hadn't occurred). The output is an injection risk score with supporting indicators, not a binary true/false verdict. This design forces a human reviewer to engage with the evidence rather than blindly trust a classification label.

Do not use this prompt as a standalone fact-checking API in production. It is a QA tool meant to be run against your verification pipeline in a pre-deployment or continuous-testing environment. The prompt's value is in exposing blind spots in your system's ability to detect synthetic quotes. After running it, you should feed the results back into your prompt engineering cycle—tightening your verification prompts, adding new eval cases, and hardening your retrieval architecture. If you are looking for a prompt to verify real-world quotes against source material, use the Quote-to-Source Comparison Prompt Template instead. This prompt is for when you suspect the quote itself is a fabrication planted to deceive the system.

This prompt template is designed for security and verification QA teams who need to test whether a quote-verification system can detect deliberately fabricated quotes embedded in otherwise legitimate content. The prompt treats the suspect quote and its surrounding context as inputs and produces a structured injection risk score with supporting indicators. It is not a general fact-checking prompt—it is specifically tuned to surface stylistic anomalies, provenance gaps, and temporal inconsistencies that signal adversarial fabrication.

textCopy
SYSTEM: You are an adversarial quote injection detector. Your task is to analyze a suspect quote embedded in surrounding content and determine whether it shows signs of deliberate fabrication. You must return a strict JSON object with no additional text.

INPUT:
- Suspect Quote: [SUSPECT_QUOTE]
- Surrounding Content: [SURROUNDING_CONTENT]
- Attribution Target: [ATTRIBUTION_TARGET]
- Known Source Corpus (optional): [KNOWN_SOURCE_CORPUS]

OUTPUT_SCHEMA:
{
  "injection_risk_score": <float 0.0-1.0>,
  "risk_category": "low" | "medium" | "high" | "critical",
  "indicators": [
    {
      "indicator_type": "stylistic_anomaly" | "provenance_gap" | "temporal_inconsistency" | "contextual_mismatch" | "source_corpus_absence",
      "description": "<specific evidence for this indicator>",
      "confidence": <float 0.0-1.0>
    }
  ],
  "explanation": "<concise reasoning summary>",
  "recommended_action": "auto_pass" | "flag_for_review" | "escalate_to_investigation"
}

CONSTRAINTS:
- Do not hallucinate sources or evidence not present in the input.
- If the attribution target has a known speaking or writing style, flag deviations from that style.
- If [KNOWN_SOURCE_CORPUS] is provided and the quote is absent, treat this as a provenance_gap indicator.
- Temporal inconsistencies include anachronistic language, impossible event references, or date mismatches.
- A score above 0.7 must trigger at least a "flag_for_review" recommendation.
- If confidence in any indicator is below 0.5, do not include it.
- Return ONLY the JSON object. No markdown fences, no preamble.

USER:
Suspect Quote: [SUSPECT_QUOTE]
Surrounding Content: [SURROUNDING_CONTENT]
Attribution Target: [ATTRIBUTION_TARGET]
Known Source Corpus: [KNOWN_SOURCE_CORPUS]

To adapt this prompt, replace each square-bracket placeholder with your actual inputs. The [SUSPECT_QUOTE] is the exact text under investigation. [SURROUNDING_CONTENT] provides the paragraph or document context where the quote appears—this is essential for detecting contextual mismatches. [ATTRIBUTION_TARGET] names the person or entity the quote is attributed to, which enables stylistic comparison. [KNOWN_SOURCE_CORPUS] is optional but strongly recommended; when provided, it should contain verified statements, writings, or transcripts from the attribution target that the model can use to detect provenance gaps. If you omit the corpus, the model will rely solely on stylistic and temporal indicators, which reduces detection power.

Before deploying this prompt in a production pipeline, validate the output against a golden dataset of known injected and legitimate quotes. Common failure modes include over-flagging quotes with unusual but authentic phrasing, missing injections that closely mimic the target's style, and producing indicator descriptions that are too vague to act on. For high-stakes verification workflows, route any output with a risk_category of high or critical to human review. Do not use this prompt as the sole gate for publishing decisions—it is a detection aid, not a definitive ruling.

The Adversarial Quote Injection Detection Prompt is designed as a triage and scoring component, not a final arbiter. It should sit early in a verification pipeline, after claim extraction but before evidence matching. Its job is to flag quotes that exhibit fabrication indicators—stylistic anomalies, provenance gaps, temporal inconsistencies—so that downstream systems can route them for deeper investigation rather than treating them as ordinary verification targets. The prompt outputs a structured injection risk score and a set of indicators, which your harness must consume and act on. Do not use this prompt as a standalone 'fake quote detector' that auto-rejects content; it is a signal generator that feeds a decision system.

Integration pattern: Wire the prompt into a pre-verification screening stage. Incoming content passes through claim extraction first. Each extracted quote is then sent to this prompt with its surrounding context and available metadata (publication date, attributed speaker, source document). The harness should enforce a strict JSON output schema with fields: injection_risk_score (0.0–1.0), risk_indicators (list of detected anomaly types), indicator_evidence (excerpts supporting each indicator), and recommended_action (one of auto_verify, flag_for_review, escalate). Validate the output against this schema before proceeding. If the model returns malformed JSON, retry once with a repair prompt that includes the schema and the raw output. If validation fails twice, route the quote to human review with a schema_failure flag.

Routing logic: Use the injection_risk_score to drive triage. Scores below 0.3 can proceed to standard quote-to-source verification. Scores between 0.3 and 0.7 should be flagged for human review with the full indicator evidence packaged for the reviewer. Scores above 0.7 should be escalated immediately and may warrant pausing automated processing of the entire source document, depending on your risk tolerance. The recommended_action field provides a model-generated suggestion, but your harness should apply its own threshold logic rather than blindly following the model's recommendation. Log every decision with the score, indicators, and routing outcome for auditability.

Model choice and latency: This prompt benefits from models with strong reasoning and anomaly detection capabilities. GPT-4o, Claude 3.5 Sonnet, or Gemini 1.5 Pro are appropriate. Avoid smaller or faster models that may miss subtle stylistic and temporal inconsistencies. Since this is a screening step, latency tolerance is moderate—expect 1–3 seconds per quote. For batch processing, implement parallel requests with a concurrency limit appropriate to your API tier. Tool use: If your harness has access to web search or document retrieval tools, consider a two-pass approach: first run the prompt without tools to get initial indicators, then for quotes flagged with provenance_gap or temporal_inconsistency, run a follow-up verification step that searches for the quote in archives or attributed sources before making a final routing decision.

Failure modes to monitor: The most common production failure is false positives on unusual but legitimate quotes—a speaker using an atypical phrase or a quote from an obscure but real source. Mitigate this by ensuring human reviewers see the full indicator evidence, not just the score. Another failure mode is context window truncation when the surrounding content is long; always pass at least 500 tokens of context on each side of the quote. Adversarial adaptation is a risk if attackers learn the detection patterns—rotate indicator descriptions in the prompt periodically and maintain a held-out test set of known injection attempts to detect regressions. Log all outputs with model version, prompt version, and timestamp for traceability. If this prompt feeds a public-facing verification product, ensure a human-in-the-loop step exists before any 'likely fabricated' label is shown to users.