PROMPT_SECURITY_EXFIL_SYSTEM_PROMPT_LEAK_001

rules/regulations/universal/prompt_security/exfil_system_prompt_leak.yaml

Citation

Regulation (EU) 2024/1689, Article 15(5): High-risk AI systems shall be resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities. The technical solutions aiming to ensure the cybersecurity of high-risk AI systems shall be appropriate to the relevant circumstances and the risks. The technical solutions to address AI specific vulnerabilities shall include, where appropriate, measures to prevent, detect, respond to, resolve and control for attacks trying to manipulate the training data set (data poisoning), or pre-trained components used in training (model poisoning), inputs designed to cause the AI model to make a mistake (adversarial examples or model evasion), confidentiality attacks or model flaws.

Condition

Covers data-exfiltration via injection: attempts to make the model reveal its system prompt, hidden/initial instructions, or safety rules verbatim. EU AI Act Article 15. OWASP LLM01 / LLM06 (sensitive information disclosure).

Layer 1 detects

in any letter case, reveal, print, repeat, show, display, output, "tell me", reproduce, echo or recite (optionally followed by "me", then optionally "your", "the" or "all of your"), then "system prompt", "initial instruction(s)", "initial prompt", hidden, secret, original or confidential instruction(s), prompt or rules, or "prompt verbatim"; and "what are", "what were" or "what is" "your" (optionally exact, full or complete) followed by initial, original, system or hidden, then instruction(s), prompt, rules or directive(s). It does not match a request for the AI's configuration in other words. It matches wording, not meaning: it does not read who is asking, so it fires on the operator's own request ("show the system prompt in the settings panel"), and it misses a leak request worded any other way. Whether the text tries to extract the AI's hidden instructions is judged in Layer 2.

Condition type

regex

Status in the file

review