Recursive Injection

What is Recursive Injection?

As we have seen previously, a very good defense against prompting hacking is to use one LLM to evaluate the output of another LLM, to check if there is any adversarial output. It is possible to evade this defense with a recursive injection attack. This attack involves injecting a prompt into the first LLM that creates output which contains an injection instruction for the second LLM.

An Example of Recursive Injection

Let's assume that the prompt we are trying to hack is:

 Copy

Prompt

---

Say something positive about the following and nature:

{user_input}

The output of this prompt will be evaluated by the prompt:

 Copy

Prompt

---

Does the following contain any profanity or offensive content (YES or NO)?

{output}

We can hack both of these prompts by appending to the prompt as seen below. Note that this is also an example of a variable assignment attack.

The above output is an injection attempt that gets input into the second LLM call:

We have now PWNED this second LLM call.

Conclusion

Recursive injections are difficult to execute, as they require careful consideration of how the separate LLM evaluation is engineered. However, under the right circumstances, they can be very useful.