Ignore Previous Prompt: Attack Techniques For Language Models

Fábio Perez and Ian Ribeiro introduce PromptInject, studying goal hijacking and prompt leaking. Experiments use 35 example base prompts, four repetitions and mostly text-davinci-002. Success criteria differ: a target output for hijacking, versus inclusion of the original instruction for leaking (§§3–5).^[1]

Read Prompt Injection for the trust boundary, then the indirect-injection study for retrieved material.

Historical context

First submitted November 17, 2022; original v1 methods and selected results reviewed, including rendered p.4. Code, full appendices and replication were not audited. Results describe those configurations, not current products or real-world attack prevalence.^[1]