# Indirect Prompt Injection

There are 2 ways that prompt injection attacks can be delivered:

1. **Directly**, for example, via a message to a chat bot.
2. **Indirectly**, where the attacker delivers the prompt via an external source. This can lead to leveraging the LLM for attacking other users and it is depending of how the model is integrated into the website.&#x20;

Normally, it should ignore instructions from within external sources, such as a web page or email. Even then we can try bypassing this by:

1. Confuse the LLM using fake markup in the indirect prompt.
2. Include fake user responses in the prompt.

### LAB: Indirect Prompt Injection

> **Goal**: `carlos` frequently uses the live chat to ask about the Lightweight "l33t" Leather Jacket product. We want to delete `carlos`.

Start by mapping the attack surface.

<figure><img src="https://3960676229-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmjLkek16kB60c2WFd5lf%2Fuploads%2FNCx7esI7t3i9CCUKulJi%2Fllm_atttacks_indirect_pi.png?alt=media&#x26;token=ac1d01ed-45ab-4da3-a5fd-53a49ac66684" alt=""><figcaption></figcaption></figure>

Playing around with the chatbot reveals that querying for a product includes its reviews.

<figure><img src="https://3960676229-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmjLkek16kB60c2WFd5lf%2Fuploads%2F0GRRYS2BhHqoU2AfakQP%2Fllm_atttacks_indirect_pi_2.png?alt=media&#x26;token=6e4c7b18-8438-4b48-9690-9c17eba6a4b1" alt=""><figcaption></figcaption></figure>

We can try leveraging fake markup to test if it is interepreted or not.

<figure><img src="https://3960676229-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmjLkek16kB60c2WFd5lf%2Fuploads%2F8ZP7hrhKxJNCSBPlHt4s%2Fllm_atttacks_indirect_pi_3.png?alt=media&#x26;token=00f21406-c082-45bc-877a-b7ef3ceb7e41" alt=""><figcaption></figcaption></figure>

Next, we can try using the `delete_account` endpoint in our review.

<figure><img src="https://3960676229-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmjLkek16kB60c2WFd5lf%2Fuploads%2FqsdavbrSYoORCG1Z7dtY%2Fllm_atttacks_indirect_pi_4.png?alt=media&#x26;token=8f95d020-ddd2-44e2-a631-9664c85b2f85" alt=""><figcaption></figcaption></figure>

For solving the lab, we can do the same for the product that `carlos` queries often.

## Training Data Poisoning

A type of indirect prompt injection in which the data the model is trained on is compromised, either has not been obtained from trusted sources or its scope was too broad.
