Securing LLMs against Prompt Injection: Exploring Threats and Solutions

Continuing our exploration of security within Large Language Model (LLM) applications, this piece follows up on the initial discussion in “Building Robust Defenses: OWASP’s Influence on LLM Applications,” where we laid out the OWASP top vulnerabilities for such systems. Here, we delve into the pertinent issue of Prompt Injection. 

Prompt Injection Explained: Unpacking Direct and Indirect Threats to LLMs

Prompt injection involves manipulating LLMs by altering prompts, which are crucial for directing responses or actions. Two primary methods, Direct Prompt Injection and Indirect Prompt Injection, pose significant security concerns. Direct injection is an outright insertion of harmful content in prompts, exploiting an LLM’s direct interface to misguide its functions. Indirect injection operates covertly, influencing LLMs by embedding prompts into external data sources that the model later processes, thereby sneaking in control commands without direct system access.

Such injections can subvert LLM functionalities, potentially triggering unauthorized actions, data exposure, or service disruptions and, in some cases, manipulating them to advance malicious agendas, such as spreading misinformation. Given their expansive impact, threats like Prompt Leaking and Jailbreaking have surfaced; the former extracts sensitive information, while the latter bypasses LLM safety features.

Case Studies: Real-World Examples of Prompt Injection Exploits

We will explore actual cases illustrating how prompt injections undermine LLM functionalities.

• The business Remoteli.io incorporated an LLM to engage with tweets concerning remote work. However, it wasn’t long before X users discovered they could manipulate the automated system, prompting it to echo their own crafted messages.

• The example below shows how “Sydney,” the codename for an earlier version of Bing Search, was exposed to an issue known as prompt leaking. By disclosing just a segment of its activation prompt, it inadvertently permitted users to extract the complete prompt without the proper authentication typically required to see it.

Jailbreaking involves overriding the built-in restrictions of a system to trigger responses that are normally blocked for safety or ethical reasons. Exploiters often utilize encoding methods like Base 64, HTML, Unicode, UTF-7, UTF-8, Octal, or Hex to bypass security by altering character representations. The example below showcases jailbreaking.

• Another common method for jailbreaking is using the DAN (Do Anything Now) prompt. DAN consists of commands that appear to coerce the model into a compromised or unrestricted state.

Check out this thread for an example of such an attack – https://chat.openai.com/share/1bee521e-8011-4b70-b5bc-4f480f01c77e

• Prompt hacking techniques have evolved beyond mere text-based exploits to include multi-modal attacks, as depicted in the image that follows.

For those with academic interests, you can explore a variety of prompt injection attacks on the suggested site – jailbreakchat.com. 

Thankfully, developers of LLMs remain keenly aware of potential threats and are quickly integrating security enhancements to avert such exploits, matching the rhythm of newly identified attack techniques in this developing area. Consequently, should you try to emulate the previously mentioned examples, the LLM would likely block your efforts.

Building Resilience: Comprehensive Defense Tactics

Prompt injection vulnerabilities stem from LLMs treating all natural language inputs alike without differentiating between user instructions and external data. Foolproof prevention is not feasible within LLMs, but practical steps and common sense solutions can reduce exposure to such attacks. Despite challenges, we will discuss several effective defenses here:

• Privilege Management:
• • Implement least privilege access for the LLM, using unique API tokens with restricted permissions.
  • Require human approval for sensitive operations to ensure actions are intentional and authorized.

• Structural Defenses:

• • Use structures such as ChatML, XML tagging, and random sequence enclosures to differentiate user input from system instructions.
  • Enclose user input within distinct boundaries, such as the “sandwich defense,” to maintain context and prevent alteration.

• Instructional Measures:

• • Direct the LLM with clear instructions that anticipate and counteract potential manipulation attempts.
  • Structure prompts with user input preceding system instructions (‘post-prompting‘) to diminish the effectiveness of injected commands.

• Input Validation:

• • Employ filtering techniques with blocklists and allowlists to control acceptable words and phrases.
  • Escape user-provided inputs that resemble system commands to neutralize potential injections.

• Monitoring and Visualization:

• • Regularly monitor LLM interactions and visually highlight responses that may come from untrusted sources or seem suspicious.

• Advanced LLM Techniques:

• • Deploy modern, more injection-resistant LLMs like GPT-4 for improved security.
  • Consider fine-tuning the model with task-specific data to reduce reliance on prompts and soft prompting as a potentially more cost-effective alternative.

• Operational Controls:

• • Use a secondary, security-oriented LLM to evaluate prompts for potential malice prior to processing.
  • Set restrictions on the length of inputs and dialogues to prevent complex injection tactics.

Implementing these strategies establishes a multi-faceted defense against prompt injections, bolstering the security framework and deterring attackers. As threats evolve, these defenses must be flexible and updatable, ensuring robust protection for systems utilizing LLMs.

Innovations in Prompt Security: Tools and Solutions for Enhancing LLM Defenses

The development community’s commitment to devising a range of solutions and tools to counter prompt injection attacks and enhance prompt quality for optimal LLM performance is promising. We will showcase a selection of these innovative examples, some currently in the prototype or experimental stages.

• Rebuff secures AI applications against prompt injection with a layered approach combining heuristic filters, dedicated LLM detection, a database of attack patterns, and canary tokens for leakage alerts and prevention.
• Deberta-v3-base-injection – This model identifies and labels prompt injection attempts as “INJECTION” while categorizing genuine inquiries as “LEGIT,” assuming that valid requests comprise various questions or keyword searches.
• Better Prompt is a testing framework for LLM prompts that gauges performance by measuring prompt perplexity, working on the principle that prompts with lower perplexity (nearing zero) tend to yield higher task performance.
• Garak is a tool designed to test an LLM’s resilience, checking for undesirable failures such as hallucination, data leakage, prompt injection, spreading misinformation, generating toxicity, jailbreaking, and other potential vulnerabilities.
• HouYi is a platform engineered for red teaming exercises, allowing users to programmatically insert prompts into LLM-integrated applications for penetration testing by crafting custom harnesses and defining the attack objectives.
• Promptmap is a tool designed to assess ChatGPT’s susceptibility to prompt injections by understanding the instance’s rules and context to craft and deliver targeted attack prompts, subsequently evaluating the success of each attack based on the responses received.

Epilogue

The field of LLM security is an evolving battleground where the dynamics of prompt injection pose a real and present danger. Yet, the ongoing efforts to harden LLMs against such threats are urgent and innovative. With the advent of specialized detection tools and the integration of robust defense techniques, a new standard is being set to both anticipate and counteract potential manipulations. The industry is certainly not resting on its laurels, as evidenced by the continuous research and development of solutions to outpace the offenders. We stand at the cusp of a significant shift – from reactive security postures to proactive, resilience-based strategies that promise to keep LLM applications safe and reliable in an ever-changing technological landscape. Moving forward, adopting and refining these approaches will be critical in empowering LLMs to fulfill their potential without compromising the principles of security and user trust.