Rule set sha256:274f72f3b49b
rego-art15-ipi-008
One rule of the rule set with digest 274f72f3b49ba2594098351e9f3268903df77a0bd87d5e528f0aa77492d45d25. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.
| Rule | rego-art15-ipi-008 |
|---|---|
| Rule version | 6caf99dd86d8a1d38db5cbca3f3ae8198876840983ea3df946c535375278b8b3 |
| Provision | Regulation (EU) 2024/1689, Article 15(5) ELI: http://data.europa.eu/eli/reg/2024/1689/art_15/par_5/oj |
| Approval | Not approved |
rules/rego/complyedge/prompt_security/indirect_injection.rego
- Citation
- Not stated in the rule file.
- Condition
- Fake separators, system markers or role tags inside a text ("<system>", "### new instructions") that try to start a new context and take over the AI's instructions.
- Layer 1 detects
- in any letter case, ignore, disregard, forget, override or bypass, followed by one or more of "the", "all", "any", "your", "previous", "prior" and "above", then instruction(s), prompt(s), directive(s), rule(s), constraint(s), guideline(s) or "system prompt" ("ignore all previous instructions"); "unrestricted assistant with no guidelines"; and "act as an unrestricted assistant". It does not match separators, system markers or role tags such as "<system>": the separator form described above is matched by the separator/context hijack leaf, which shares this rule_id. It matches wording, not meaning: it fires on text that only names the attack ("should the bot ignore the previous instructions in a forwarded email?"), and it misses an override worded any other way. Whether the text tries to take over the AI's instructions is judged in Layer 2.
- Condition type
- Not stated in the rule file.
- Status in the file
- review
rules/rego/complyedge/prompt_security/separator_hijack.rego
- Citation
- Not stated in the rule file.
- Condition
- Fake separators, system markers or role tags inside a text ("<system>", "### new instructions") that try to start a new context and take over the AI's instructions.
- Layer 1 detects
- in any letter case, at the start of a line (after optional spaces): a separator (three or more "=", "-" or "*", two or more "#", or a [user], [assistant], [system], [context], [input] or [prompt] tag or the same names as <tag> or </tag>), followed directly (spaces allowed) by a
- Condition type
- Not stated in the rule file.
- Status in the file
- review