プロンプトインジェクション攻撃

An AI application may receive higher-priority task instructions alongside material it is meant to analyze. Prompt injection exploits failures to maintain that distinction, attempting to make the application follow an adversary’s instructions instead of the authorized task. Direct attacks arrive in supplied adversarial input; indirect attacks are placed in external material that the system later retrieves or reads. The cited indirect-injection study demonstrates attacks against particular LLM-integrated applications and develops a taxonomy of goals and delivery methods. Some attacks can cause answer manipulation, information leakage, or unauthorized actions when the application has the relevant access. Others target availability, such as inhibiting useful answers or disrupting a search task. A model-only response error and an executed tool action have different consequences. Application controls therefore matter alongside model behavior. OWASP’s guidance includes defining expected behavior, separating external content, constraining privileges, and validating outputs and actions. A prompt disclaimer alone is not a complete security boundary, but neither is every failure inevitable because a transformer uses attention. The Instruction Hierarchy research explicitly studies training models to prioritize privileged instructions and disregard conflicting lower-priority content. Its evaluated robustness improvement is a research result, not a proof that every attack is blocked. OWASP also describes multimodal injection, including adversarial instructions embedded in images. Evaluating only plain text would miss that input channel. An application should identify the inputs and capabilities it actually supports and measure both attack resistance and whether legitimate analysis tasks remain usable.