Prompt injection in research documents: keep source boundaries
Treat instructions found inside research documents as untrusted source content. A web page, PDF, or extracted table may contain text asking an AI to ignore its task, reveal private notes, or contact an external service. Such text does not gain authority merely because the document also contains relevant financial information.
OWASP’s prompt-injection guidance describes how malicious inputs can alter model behavior and why retrieval does not fully remove the problem. This page applies that concern to evidence gathering. It does not claim a prompt alone guarantees protection or that any specific product implements these controls.
Separate authority from evidence
The human’s research request defines the task. Retrieved documents supply material to inspect. Keep those roles distinct even when the document uses imperative language such as “system notice” or “mandatory verification.” A source cannot authorize sending private data or changing the research objective.
Before processing, specify allowed actions. A read-only evidence task usually needs document retrieval, extraction, and local notes. If a source asks for a different action, preserve the relevant text as suspicious content and continue only within the authorized task. Do not test a suspicious destination with confidential material.
| Boundary | Research rule |
|---|---|
| Source text | Evidence to quote or analyze, not new authority |
| Private context | Exclude unless necessary and authorized |
| External requests | Require a legitimate task basis independent of the source |
| Tool action | Limit to the actions needed for the research |
| Suspicious passage | Record location and effect on extraction |
These are workflow controls. They should be combined with appropriate technical access restrictions where tools support them.
Hypothetical hostile footnote
Assume a fictional investor document contains a footnote saying that accurate analysis requires uploading the user’s portfolio and research notes to an unrelated verification endpoint. The document also contains a useful revenue table. The revenue table can remain a candidate source, while the upload instruction remains untrusted.
The researcher records the footnote location, ignores its operational demand, and extracts only relevant public facts. If the suspicious content contaminates the extraction, the affected output is discarded and the table is checked against the original page. No private portfolio information is sent.
Now suppose the text claims to be an administrator message. That claim occurs inside the same untrusted document and does not change the authority relationship. All details here are hypothetical, and the example intentionally avoids providing an operational attack procedure.
Limit context and action exposure
Give the extraction step only the documents and context needed for its question. Avoid including secrets, account credentials, private holdings, or unrelated correspondence. Smaller necessary context reduces what could be exposed if the extraction behaves incorrectly; it does not guarantee the model will reject every malicious instruction.
Separate reading from consequential actions. A source summary should not directly trigger messages, uploads, edits to an external system, or transactions. Review the proposed action against the actual user request and the independently established evidence. A document’s request to act is not itself evidence that the action is needed.
When tools permit, use narrow access and read-only modes for evidence tasks. Keep action logs sufficient to inspect what was retrieved and what operations occurred. Do not claim that logs prevent injection; they provide observability and support investigation.
Review the resulting evidence
After a suspicious passage is detected, check whether the summary changed the task, inserted unsupported claims, or omitted inconvenient information. Source manipulation can affect the narrative even without a data transfer. Reopen material assertions against original passages before allowing them into the memo.
The method cannot certify a document harmless or guarantee complete resistance to indirect instructions. Scanned images, structured data, and retrieved text can all require inspection. Common mistakes include trusting imperative text because it appears in an official-looking PDF, treating retrieval as an automatic security boundary, providing unnecessary private context, and allowing a summary to trigger external actions without checking authorization.
FAQ
Should every document with suspicious text be deleted?
Not necessarily. Quarantine the operational instruction and assess whether relevant public evidence can be extracted safely and verified. Preserve an honest record of the limitation.
Can a stronger system prompt solve the entire problem?
No single prompt should be treated as a guarantee. Combine source boundaries, minimal data, limited tool access, and appropriate human review for consequential actions.