AI › Module 3 › Lesson 2
Indirect Injection
Indirect injection literacy names attacks hidden in retrieved docs, emails, or web pages — recognize patterns on YOUR $AI_LAB notes, not stranger RAG pipelines.
Visual · t32_indirect_injection
Indirect injection literacy. $AI_LAB only. Original Cyberlium.
Opening
The poison hides in the retrieval — literacy names indirect injection so you validate RAG sources on toys you control.
Indirect prompt injection embeds malicious instructions in content the model retrieves — poisoned web pages, email bodies, uploaded PDFs, or compromised knowledge-base chunks. The user may ask an innocent question; the model reads hidden 'ignore instructions' text from untrusted retrieval. Defender fix: source validation, sanitization, and retrieval isolation. Cyberlium names indirect injection on YOUR $AI_LAB — craft fictional poisoned note files for toy RAG demo only. Next: Defenses Named.
1. Indirect injection sources (named)
Poisoned RAG document: hidden instructions in markdown or white text. Email body: malicious text in thread the bot summarizes. Web page: attacker-controlled content fetched by browsing tool. Uploaded file: PDF with embedded override text.
On $AI_LAB, write one fictional poisoned note for toy RAG — label detection signal defenders watch for.
Command guide
Try these commands — Indirect injection sources (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP LLM01 — https://owasp.org/www-project-top-10-for-large-language-model-applications/ MITRE ATLAS — https://atlas.mitre.org/ CISA AI — https://www.cisa.gov/ai
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export AI_LAB=${AI_LAB:-$HOME/cyberlium-lab/t32-ai}
cat > "$AI_LAB/injection/indirect-injection-named.txt" <<'EOF'
Indirect prompt injection — NAMED LITERACY:
Vector: poisoned webpage, email, PDF, RAG chunk embedded in context
Model reads untrusted doc → hidden instruction alters behavior
Defenses: source tagging, retrieval filtering, output validation, sandbox tools
Detection: monitor for instruction-like patterns in retrieved content
Lab: markdown notes only — no hosting malicious pages against strangers
EOFCommand — copy this
grep -E 'Indirect|Defenses|RAG' "$AI_LAB/injection/indirect-injection-named.txt" curl -sS https://atlas.mitre.org/ | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: OWASP LLM01 (https://owasp.org/www-project-top-10-for-large-language-model-applications/); MITRE ATLAS (https://atlas.mitre.org/); CISA AI (https://www.cisa.gov/ai). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why indirect injection bypasses user vigilance
User did not type the attack — retrieval pipeline pulled it in. Defenders audit ingestion, chunk boundaries, and source allowlists. Logging retrieved chunks helps IR reconstruct what the model saw.
Students practice on self-authored poisoned notes in $AI_LAB — never poison stranger knowledge bases or employer prod RAG.
3. Literacy ≠ poisoning stranger data stores
Forbidden: uploading poisoned docs to stranger or employer RAG without authorization. Allowed: indirect injection card — source type, fictional poisoned sample path on $AI_LAB, sanitization defense.
Ship: indirect injection card for YOUR lab notes. Next: Defenses Named.
4. What you ship: indirect injection card for $AI_LAB
Source type, fictional poisoned sample, sanitization defense. $AI_LAB named. NO stranger RAG. chmod 600.
5. What you record before the next lesson
Date. Indirect injection card. $AI_LAB named. File t32-m03-l02-indirect-injection.txt chmod 600.
6. Wrong vs right: stranger SaaS vs YOUR toy LLM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Poison employer knowledge base 'for testing.' Skip source validation in lab notes.
Right
Write indirect injection card with fictional $AI_LAB poisoned note. Next: Defenses Named.
Mission: name indirect injection on YOUR lab notes
1) Pick one source type (RAG, email, web). 2) Write fictional poisoned snippet for toy demo. 3) Name one sanitization or allowlist defense. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Log what retrieval returned — indirect injection IR needs the chunk text.
Knowledge Check
APPLY: Indirect injection hides instructions in:
Multiple choice
Knowledge Check
APPLY: True or False: RAG pipelines should validate and sanitize untrusted retrieved content.
True or False
Knowledge Check
APPLY: Indirect injection literacy on Cyberlium avoids:
Multiple choice