Indirect Injection
Indirect injection literacy names attacks hidden in retrieved docs, emails, or web pages — recognize patterns on YOUR $AI_LAB notes, not stranger RAG pipelines.
Visual · t32_indirect_injection
Indirect injection literacy. $AI_LAB only. Original Cyberlium.
The poison hides in the retrieval — literacy names indirect injection so you validate RAG sources on toys you control.
Indirect prompt injection embeds malicious instructions in content the model retrieves — poisoned web pages, email bodies, uploaded PDFs, or compromised knowledge-base chunks. The user may ask an innocent question; the model reads hidden 'ignore instructions' text from untrusted retrieval. Defender fix: source validation, sanitization, and retrieval isolation. Cyberlium names indirect injection on YOUR $AI_LAB — craft fictional poisoned note files for toy RAG demo only. Next: Defenses Named.
1. Indirect injection sources (named)
Poisoned RAG document: hidden instructions in markdown or white text. Email body: malicious text in thread the bot summarizes. Web page: attacker-controlled content fetched by browsing tool. Uploaded file: PDF with embedded override text.
On $AI_LAB, write one fictional poisoned note for toy RAG — label detection signal defenders watch for.
Command guide
Try these commands — Indirect injection sources (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, curl. Reference sites: OWASP LLM01 (https://owasp.org/www-project-top-10-for-large-language-model-applications/); MITRE ATLAS (https://atlas.mitre.org/); CISA AI (https://www.cisa.gov/ai). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why indirect injection bypasses user vigilance
User did not type the attack — retrieval pipeline pulled it in. Defenders audit ingestion, chunk boundaries, and source allowlists. Logging retrieved chunks helps IR reconstruct what the model saw.
Students practice on self-authored poisoned notes in $AI_LAB — never poison stranger knowledge bases or employer prod RAG.
3. Literacy ≠ poisoning stranger data stores
Forbidden: uploading poisoned docs to stranger or employer RAG without authorization. Allowed: indirect injection card — source type, fictional poisoned sample path on $AI_LAB, sanitization defense.
Ship: indirect injection card for YOUR lab notes. Next: Defenses Named.
4. What you ship: indirect injection card for $AI_LAB
Source type, fictional poisoned sample, sanitization defense. $AI_LAB named. NO stranger RAG. chmod 600.
5. What you record before the next lesson
Date. Indirect injection card. $AI_LAB named. File t32-m03-l02-indirect-injection.txt chmod 600.
6. Wrong vs right: stranger SaaS vs YOUR toy LLM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Poison employer knowledge base 'for testing.' Skip source validation in lab notes.
- Right: Write indirect injection card with fictional $AI_LAB poisoned note. Next: Defenses Named.
Mission: name indirect injection on YOUR lab notes
1) Pick one source type (RAG, email, web). 2) Write fictional poisoned snippet for toy demo. 3) Name one sanitization or allowlist defense. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Log what retrieval returned — indirect injection IR needs the chunk text.
APPLY: Indirect injection hides instructions in:
APPLY: True or False: RAG pipelines should validate and sanitize untrusted retrieved content.
APPLY: Indirect injection literacy on Cyberlium avoids:
Defenses Named
Part of AI Security with AI — Prompt Injection Named.
Lab — Injection
Part of AI Security with AI — Prompt Injection Named.
Quiz — Prompt Injection
Part of AI Security with AI — Prompt Injection Named.