Rule set sha256:026d59ecf618
rego-art15-ipi-008
One rule of the rule set with digest 026d59ecf6186f63d5f16b503c9429b896cee28ca509559704824e11f4530007. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.
rules/rego/complyedge/prompt_security/indirect_injection.rego
- Citation
- Not stated in the rule file.
- Condition
- Fake separators, system markers or role tags inside a text ("<system>", "### new instructions") that try to start a new context and take over the AI's instructions.
- Layer 1 detects
- in any letter case, ignore, disregard, forget, override or bypass, followed by one or more of "the", "all", "any", "your", "previous", "prior" and "above", then instruction(s), prompt(s), directive(s), rule(s), constraint(s), guideline(s) or "system prompt" ("ignore all previous instructions"); "unrestricted assistant with no guidelines"; and "act as an unrestricted assistant". It does not match separators, system markers or role tags such as "<system>": the separator form described above is matched by the separator/context hijack leaf, which shares this rule_id. It matches wording, not meaning: it fires on text that only names the attack ("should the bot ignore the previous instructions in a forwarded email?"), and it misses an override worded any other way. Whether the text tries to take over the AI's instructions is judged in Layer 2.
- Condition type
- Not stated in the rule file.
- Status in the file
- approved
rules/rego/complyedge/prompt_security/separator_hijack.rego
- Citation
- Not stated in the rule file.
- Condition
- Fake separators, system markers or role tags inside a text ("<system>", "### new instructions") that try to start a new context and take over the AI's instructions.
- Layer 1 detects
- in any letter case, at the start of a line (after optional spaces): a separator (three or more "=", "-" or "*", two or more "#", or a [user], [assistant], [system], [context], [input] or [prompt] tag or the same names as <tag> or </tag>), followed directly (spaces allowed) by a
- Condition type
- Not stated in the rule file.
- Status in the file
- approved