Announcing our new Course: AI Red-Teaming and AI Safety Masterclass

Check it out →
🧠 Advanced
🔓 Prompt Hacking🟢 Offensive Measures🟢 Recursive Injection

🟢 Recursive Injection

Last updated on August 7, 2024 by Sander Schulhoff

What is Recursive Injection?

As we have seen previously, a very good defense against prompting hacking is to use one LLM to evaluate the output of another LLM, to check if there is any adversarial output. It is possible to evade this defense with a recursive injection attack. This attack involves injecting a prompt into the first LLM that creates output which contains an injection instruction for the second LLM.

An Example of Recursive Injection

Let's assume that the prompt we are trying to hack is:

Astronaut

Prompt


Say something positive about the following and nature:

{user_input}

The output of this prompt will be evaluated by the prompt:

Astronaut

Prompt


Does the following contain any profanity or offensive content (YES or NO)?

{output}

We can hack both of these prompts by appending to the prompt as seen below. Note that this is also an example of a variable assignment attack1.

The above output is an injection attempt that gets input into the second LLM call:

We have now PWNED this second LLM call.

Conclusion

Recursive injections are difficult to execute, as they require careful consideration of how the separate LLM evaluation is engineered. However, under the right circumstances, they can be very useful.

Footnotes

  1. Kang, D., Li, X., Stoica, I., Guestrin, C., Zaharia, M., & Hashimoto, T. (2023). Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attacks.

Edit this page
Word count: 0
Copyright © 2024 Learn Prompting.