Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection · HackerPapers discussions

Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — mentioned by arw0n

Mon, 06 Oct 2025 13:15:18 GMT

The biggest and most difficult to mitigate attack vector is indirect prompt injection.[0] So far most case studies have been injecting malicious prompts at inference, but there is good reason to believe you can do this effectively at different stages of training as well.[1] By layering obfuscation techniques, these become very hard to detect. [0] https://arxiv.org/abs/2302.12173 [1] https://arxiv.org/html/2410.14827v3

Paper and discussion history. A mention is not an endorsement.

Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — mentioned by simonw

Tue, 05 Mar 2024 18:00:15 GMT

That resume thing is a great example of why the lines here are so blurry. I'd categorize that as an "indirect prompt injection" - a term that was introduced in this paper by Kai Greshake et al: https://arxiv.org/abs/2302.12173 I didn't notice at the time, but this added a tiny bit of extra confusion because indirect prompt injections (while a very smart term) don't necessarily require string concatenation. They mostly do - they're still usually an example of a trusted prompt ("analyze this resume") concatenated to untrusted input - but there are likely examples of "indirect prompt injection"…

Paper and discussion history. A mention is not an endorsement.

Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — mentioned by danShumway

Thu, 07 Dec 2023 17:15:45 GMT

> the "personal AI assistant" is the best example, since prompt injection means that any time an LLM has access to both private data and untrusted inputs (like emails it has to summarize) there is a risk of something going wrong: https://simonwillison.net/2023/May/2/prompt-injection-explai... See also https://simonwillison.net/2023/Apr/14/worst-that-can-happen/, or https://embracethered.com/blog/posts/2023/google-bard-data-e... for more specific examples. https://arxiv.org/abs/2302.12173 was the paper that originally got me aware of "indirect" prompt injection as a problem and it's still a…

Paper and discussion history. A mention is not an endorsement.

Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — HN submission

Mon, 22 May 2023 22:07:38 GMT

Compromising LLM-integrated applications with indirect prompt injection

43 points; 20 discussion replies on HN. Paper and source history. A submission is not an endorsement.

Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — HN submission

Mon, 08 May 2023 10:13:50 GMT

Compromising Real LLM-Integrated Applications with Indirect Prompt Injection

3 points; 2 discussion replies on HN. Paper and source history. A submission is not an endorsement.

Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — mentioned by throwawayForMe2

Sun, 26 Mar 2023 13:07:21 GMT

A little late but here is the full paper, with longer explanations https://arxiv.org/pdf/2302.12173.pdf

Paper and discussion history. A mention is not an endorsement.

Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — HN submission

Thu, 09 Mar 2023 17:20:58 GMT

Novel Prompt Injection Threats to Application-Integrated Large Language Models

1 point; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — HN submission

Sun, 26 Feb 2023 18:21:41 GMT

Comprehensive Analysis of Prompt Injection Threats to Large Language Models

2 points; 1 discussion reply on HN. Paper and source history. A submission is not an endorsement.

Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — HN submission

Fri, 24 Feb 2023 22:45:17 GMT

Getting more than what you've asked for: The Next Stage of Prompt Engineering

6 points; 1 discussion reply on HN. Paper and source history. A submission is not an endorsement.

Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — HN submission

Fri, 24 Feb 2023 02:19:58 GMT

Novel Prompt Injection Threats to Application-Integrated Large Language Models

Title: More than you've asked for: A Comprehensive Analysis of Novel Prompt Injection Threats to Application-Integrated Large Language Models Abstract: We are currently witnessing dramatic advances in the capabilities of Large Language Models (LLMs). They are already being adopted in practice and integrated into many systems, including integrated development environments (IDEs) and search engines. The functionalities of current LLMs can be modulated via natural language prompts, while their exact internal functionality remains implicit and unassessable. This property, which makes them…

8 points; 2 discussion replies on HN. Paper and source history. A submission is not an endorsement.