PROMPT_SECURITY_INDIRECT_INJECTION_AI_ADDRESSED_DIRECTIVE_001

rules/regulations/universal/prompt_security/indirect_injection_ai_addressed_directive.yaml

Citation

Regulation (EU) 2024/1689, Article 15(5): High-risk AI systems shall be resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities. The technical solutions aiming to ensure the cybersecurity of high-risk AI systems shall be appropriate to the relevant circumstances and the risks. The technical solutions to address AI specific vulnerabilities shall include, where appropriate, measures to prevent, detect, respond to, resolve and control for attacks trying to manipulate the training data set (data poisoning), or pre-trained components used in training (model poisoning), inputs designed to cause the AI model to make a mistake (adversarial examples or model evasion), confidentiality attacks or model flaws.

Condition

Covers indirect prompt injection where untrusted content directly addresses the AI ("attention AI assistant", "note to any language model") to smuggle instructions through retrieved data. EU AI Act Article 15. OWASP LLM01.

Layer 1 detects

in any letter case, "attention" (optionally followed by a comma or colon) followed by AI, language model, assistant, LLM or chatbot; "note to" (optionally "any" or "the") followed by AI, language model, assistant or LLM; "message", "instruction" or "instructions" for or to (optionally "the") AI, assistant, language model or LLM, followed by "reading" or "processing"; "if you are", "if you're" or "if youre" followed by "a" or "an", then AI, language model, assistant or LLM, then reading, processing, parsing, summarising or summarizing; "dear" followed by AI, assistant, language model or chatbot; note, notice, instruction or instructions, for or to (optionally "the"), automate, automated, automatic or machine, then processing, handling, system, workflow, agent or reader ("note for automated processing"); and the German "Hinweis für die" (or "fuer die") automatische or automatisierte Verarbeitung or Bearbeitung. It matches wording, not meaning: it does not read who wrote the text, so it fires on the operator's or user's own words in the same form ("Note to the assistant: keep answers short"), and it misses a directive to an AI worded any other way. Whether the text is a third party's attempt to redirect the AI is judged in Layer 2.

Condition type

regex

Status in the file

review