الأمن الفوري لمنظمة العفو الدولية

The problem can arise in user input, retrieved documents, webpages, images, or tool responses. Defenses must limit the consequences as well as detect suspicious text.

النقاط الرئيسية

• Distinguish instructions from processed content.
• Limit permissions independently of the model.
• Test trust boundaries across input channels.

Separate the user’s authorized task from the content being processed. A document may legitimately contain instructions as part of its subject matter. Those words should not automatically control the assistant’s tools, account access, or response policy. Keep privileges narrow. A summarization task generally does not require unrestricted file access or permission to send messages. Enforce those limits in the application so a model error cannot silently create a broader capability. Validate consequential outputs and actions against the original request. Check the destination, affected records, data being transmitted, and required approval. An external page claiming that the user approved something is not equivalent to an actual user instruction. Build regression cases that vary the location and format of untrusted instructions. Test direct input, retrieved passages, and tool results in a controlled environment. Review whether the application preserves useful task performance while resisting redirection. Avoid claims of a foolproof prompt-injection filter; layered controls and ongoing testing are more credible.

1. Construct a test page containing a normal policy paragraph and a sentence telling the assistant to upload unrelated files.
2. Ask only for the policy summary. Verify that the summary uses relevant facts and that no upload tool is called.
3. Repeat with the instruction in a quoted block and in a tool result to test the same trust boundary across formats.

This bounded defensive exercise verifies task adherence without using real private files.