A retrieved RAG document says to ignore previous instructions.
Use it as evidence without executing its instructions.
Choose two appropriate defenses.
Mark retrieved documents as untrusted data separated from fixed instructions, and protect tools or sensitive actions with authorization and review.
Detailed explanation
Instructions in a document are less likely to change application control.
Instructions in a document are less likely to change application control.
A search result cannot directly trigger an unsafe operation.
A search result cannot directly trigger an unsafe operation.
External data can take over application control.
External data can take over application control.
Internal content can contain mistakes or injected instructions.
Internal content can contain mistakes or injected instructions.
Try it yourself
An example you can run in a temporary verification environment.
AWS公式AIF-C01 Domain 2.3とAmazon Bedrockのプロンプトインジェクション対策を確認する。Expected result
RAGの検索結果を命令から分離し、危険な操作を別の認可境界で守れる。Key points
- Untrusted data
- Delimiters
- Tool authorization
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.