PROMPT_SECURITY_INDIRECT_INJECTION_SEPARATOR_HIJACK_001

rules/regulations/universal/prompt_security/indirect_injection_separator_hijack.yaml

Citation

Regulation (EU) 2024/1689, Article 15(5): High-risk AI systems shall be resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities. The technical solutions aiming to ensure the cybersecurity of high-risk AI systems shall be appropriate to the relevant circumstances and the risks. The technical solutions to address AI specific vulnerabilities shall include, where appropriate, measures to prevent, detect, respond to, resolve and control for attacks trying to manipulate the training data set (data poisoning), or pre-trained components used in training (model poisoning), inputs designed to cause the AI model to make a mistake (adversarial examples or model evasion), confidentiality attacks or model flaws.

Condition

Covers indirect prompt injection via separator-hijack patterns: content embedding delimiters that purport to end the user-input region and start fake new-instructions. Tool-mediated IPI shape. EU AI Act Article 15 Layer-1 catch. Source: OWASP LLM01.

Layer 1 detects

in any letter case, at the start of a line (after optional spaces): a separator (three or more "=", "-" or "*", two or more "#", or a [user], [assistant], [system], [context], [input] or [prompt] tag or the same names as <tag> or </tag>), followed directly (spaces allowed) by a marker: "end of input", "end of user input", "end of prompt", "end of context" or "end of message" (the words joined by spaces, hyphens or underscores, "of" and "user" optional); "new instructions", "new prompt", "new system prompt" or "new system message"; "begin new", "begin system" or "begin assistant"; "system override" or "system prompt"; "admin override"; or "important instruction(s)" or "important note". A tag or separator on its own, such as a bare "<system>", does not match. It matches wording, not meaning: it fires on ordinary formatting in the same form, such as a markdown heading "## Important note", and it misses a context hijack built any other way. The semantic condition in the file is not run by the engine. Whether the text tries to start a new context and take over the AI's instructions is judged in Layer 2.

Condition type

regex; semantic condition in the file, not run by the engine

Status in the file

approved