The authors systematically tested indirect prompt injection across different presentation channels (follow-up, RAG, tool output) and found that attacks re-wrapped in different channels succeed at higher rates.
LLM defenses against prompt injection are channel-conditioned and require deployment-aware training
TRACER training reduces attack success from 65.5% to 6.1% on RAG-framed attacks while preserving 78–82% clean accuracy
Academic
Kshitij Mishra · Salem Lahlou · Nils Lukas
Mohamed bin Zayed University of Artificial Intelligence
Research Digest··2 min read
The authors show that the same indirect prompt injection succeeds at dramatically different rates depending on the presentation channel, revealing a 'framing gap'.
§