Prompt injection versus an ordinary user instruction

Applications need user instructions; treating every imperative sentence as an attack makes the product unusable. Prompt injection is about trust and authority: untrusted content attempts to redirect the system, disclose data or invoke capabilities beyond the authorized task.

Label source and authority

The offline foundations lab compares two authored items.

from foundation_cases import injection_case

result = injection_case()
assert result["ordinary_instruction"] == "Summarize the policy"
assert "email secrets" in result["injection"]
assert result["authority_boundary_preserved"] is True
assert result["external_write_authorized"] is False

The user’s permitted request defines intent. The retrieved document’s instruction to ignore rules and email secrets remains untrusted content. No model or email tool executes.

Enforce boundaries outside the prompt

Track whether text came from the authenticated user, application, retrieved document or tool. Separate trusted instructions from quoted content. Restrict tools to least privilege, validate arguments and require an explicit approval for consequential external writes.

The model can help classify or extract, but it should not decide its own authorization. A document, website or tool response cannot expand user-granted scope. Sanitize outputs before rendering and protect secrets from entering prompts where possible.

Test realistic ambiguity

Include legitimate documents that discuss attacks, user requests to transform quoted instructions, indirect injection in metadata, encoded text, conflicting sources and multi-turn attempts. Score both task completion and security invariants. A defence that blocks all retrieved text fails the task even if it stops injection.

Layer controls: trusted-channel instructions, source labels, limited context, tool allowlists, schema validation, approval gates, output monitoring and incident logging. Assume no single prompt completely solves injection.

The Generative & Agentic AI course connects this distinction to RAG ingestion, agent tools, MCP identity and adversarial evaluation.

Exercise

Build 20 cases split across normal user instructions, benign quoted imperatives, direct injection and indirect injection. Identify which layer blocks unauthorized behaviour and measure false positives on legitimate tasks.

Continue learning

This article is part of the LLM fundamentals and prompt design sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Build an offline fixture for an LLM integration.
• Continue with Use a model-generated explanation without treating it as proof.

References: OWASP prompt injection and NIST Generative AI Profile.