pikit: A Composable Toolkit for Indirect Prompt Injection Research and Evaluation
Tencent's pikit toolkit benchmarks indirect prompt injection attacks, channels, and defenses for LLM coding agents.
Researchers introduce pikit, a composable toolkit for indirect prompt injection covering 13 attack methods, 16 text and file channels, nine prevention strategies, and three offline detectors. On a production-like coding agent, prompt-level defenses cut attack success by 71.8% relative, with few-shot warnings and instruction hierarchy strongest. Offline detectors reached perfect precision but low recall. Each run logs prompts, traces, transcripts, and verdicts; code is in Tencent's AI-Infra-Guard repository.
- Toolkit spans 13 attacks, 16 channels, and nine defenses.
- Prevention strategies cut relative attack success by 71.8%.
- Few-shot warning and instruction hierarchy protected best.
- Offline detectors had perfect precision but low recall.
- Code is in Tencent's AI-Infra-Guard repository.
From the original article
1 min read at arxiv.orgIndirect prompt injection embeds malicious instructions within external content retrieved by LLM-based agents, altering target behavior without user authorization.
By Zonghao Ying · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.