PROMPT_SECURITY_EXFIL_MARKDOWN_IMAGE_CHANNEL_001

rules/regulations/universal/prompt_security/exfil_markdown_image_channel.yaml

Citation

Regulation (EU) 2024/1689, Article 15(5): High-risk AI systems shall be resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities. The technical solutions aiming to ensure the cybersecurity of high-risk AI systems shall be appropriate to the relevant circumstances and the risks. The technical solutions to address AI specific vulnerabilities shall include, where appropriate, measures to prevent, detect, respond to, resolve and control for attacks trying to manipulate the training data set (data poisoning), or pre-trained components used in training (model poisoning), inputs designed to cause the AI model to make a mistake (adversarial examples or model evasion), confidentiality attacks or model flaws.

Condition

Covers the markdown-image / link data-exfiltration channel used by indirect prompt injection: a markdown image or link whose URL query smuggles captured data to an external host. EU AI Act Article 15. OWASP LLM01 / LLM06.

Layer 1 detects

in any letter case, a markdown image "![...](", an HTML "<img ... src=" (the quote optional) or a markdown link "](", directly followed by an http or https URL whose query string (before any ")", quote or space) contains a parameter named data, leak, exfil, prompt, sys, system, content, payload, q, c, s, secret or token ("?q=" or "&token="). It matches the shape of the link, not what it carries: it does not read whether the URL holds conversation or secret data or who put it there, so it fires on an ordinary search link the user asked for ("[results](https://www.example.com/search?q=opa)"), and it misses a URL that carries data under any other parameter name or in its path. Whether the link exfiltrates data is judged in Layer 2.

Condition type

regex

Status in the file

approved