Quilzomanual

Stop prompt injection in RAG: screening, guardrails and poisoned pages

Four layers between a planted instruction and a visitor, each one working without the others.

In the adminChatbots

Indirect prompt injection is an instruction hidden in content an AI reads rather than typed by its user: a sentence in a page, a document or a review that says "ignore your previous instructions". It is number one on OWASP's Top 10 for LLM applications, and a poisoned document in a knowledge base (OWASP LLM08) is how it reaches a RAG chatbot.

Quilzo's chatbots already limit the damage: they can only answer and offer the actions you declared, every sentence must cite a passage, and with a model each sentence is checked against that passage. The layers on this page stop planted text from reaching the model in the first place, and tell you where it came from.

1. Text nobody can see is removed

Before any model reads text, characters that draw nothing are taken out: the Unicode tag block, zero-width characters and bidirectional controls. They are a known way to hide an instruction from the person reviewing a page while a model still reads it. This is always on.

2. Passages that speak to an AI are left out

A page is written for the people who read it. Text that addresses the AI instead, such as "ignore your previous instructions", "if you are an AI assistant", a fake system prompt, or "do not tell the user", has the shape of a planted instruction. As a chatbot's knowledge is indexed, those passages are left out of what it reads, and you are told which pages and why.

  1. See what was left out

    Ask something under Try it on the chatbot's page. Above the answer, Some of what it could read is not being used lists each page with a passage held back, and the reason.

    The chatbot test console: ink-care is left out of what it reads, because it tells an AI to set its instructions aside; the answer comes from the Returns page instead
    A page carrying a planted instruction. Its passage is left out; the answer comes from Returns.

  2. Fix the page

    A held passage is not deleted or hidden on the site; it is only left out of what the chatbot reads. The passage is the unit, so any honest text sharing it is left out too. Remove the planted sentence, publish, and the page is read again.

  3. Keep instructions only where you mean to

    A chatbot whose pages discuss these attacks on purpose, such as a security knowledge base, can keep such passages: tick Read passages that address an AI in its settings. The AI evidence report counts how many chatbots screen their knowledge.

Agents get the same screening for what they retrieve. An agent declared with "retrieval": {"keep_instructions": true} keeps such passages, for the same reason.

3. A second look by an outside classifier

Quilzo's own screening is a list of rules. A classifier trained on far more attacks will notice some a list does not, so you can add one as a second check:

guardrail.kindService
lakeraLakera Guard (/v2/guard). The address defaults to Lakera's.
model-armorGoogle Cloud Model Armor (sanitizeUserPrompt). Set its address in guardrail.url.
genericA classifier on your own network that takes {"text"} and answers {"flagged"}, such as Llama Prompt Guard 2 behind a small HTTP wrapper.
quilzo config set guardrail.kind lakera
export QUILZO_GUARDRAIL_KEY=…        # read from the environment, never stored in a setting

It is asked about a chatbot's knowledge as it is indexed, and about each visitor's question. What it flags in the knowledge is left out. A flagged question is counted as an injection attempt for the shield, and never refused on the classifier's word alone. The key is only sent over https; without one, the classifier must be on your own network.

It fails open, and says so. If the classifier does not answer within three seconds, the text stays as Quilzo's own checks left it and the miss is counted, so an outage is a number somebody sees rather than an outage of the site.

4. A new page that answers everything

A poisoned page is written to be retrieved for every question. So Quilzo watches for its shape: a page that entered a chatbot's knowledge in the last seven days and becomes the source it cites first for ten different questions within an hour. When that happens, the shield's knowledge-takeover playbook tells the security contact and opens a case. A popular new page can look the same, so nothing is refused: somebody reads the page.

Questions that look like injection attempts are counted too. The chatbot-injection playbook acts on repeated attempts from one source, and chatbot-flood watches for attempts arriving from everywhere at once. See The shield.

Next