When data becomes an instruction
Exploring the trust boundary between system instructions and untrusted retrieved content.
01
Objective
How can an application keep retrieved text from becoming an instruction? This is a sample investigation outline; testing has not been performed.
02
Threat Model
To document: the attacker’s control, assets at risk, trust boundaries, assumptions, and explicitly excluded behavior.
03
Environment
To document: an authorized, isolated environment with synthetic data, tool versions, configuration, and a reproducible setup.
04
Methodology
Proposed approach: establish a baseline, change one variable at a time, capture outputs, repeat tests, and record negative results as well as unexpected behavior.
05
Attack Path
No attack path has been validated. A completed study will describe preconditions and a scoped sequence of steps in the authorized environment.
06
Evidence
No experimental evidence collected. Future entries should include sanitized artifacts and exact reproduction conditions, with private data removed.
07
Impact
Not assessed. A completed study must distinguish observed behavior from hypothetical downstream consequences.
08
Mitigation
To evaluate: enforce boundaries outside model-generated text, constrain permissions, and verify proposed controls through repeat testing. No mitigation effectiveness is claimed here.
09
Lessons Learned
Pending actual testing. This section will record uncertainty, limitations, failed approaches, and changes to the original assumptions.
10
References
No sources attached to this sample outline. Add primary documentation, lab specifications, and relevant research when the investigation is conducted.