During a permitting red-team, an uploaded notes file contains text that tries to override policy instructions when the copilot summarizes the document. What issue should testers report?
Select an answer to reveal the explanation.
Short Explanation
A sneaky line inside an uploaded permit note can boss the summarizer around—that's indirect injection riding in with the paperwork. Report the untrusted-document path; don't chalk it up to a bloated file or a training-data problem.
Full Explanation
During a permitting red-team, an uploaded notes file containing text that tries to override policy instructions when the copilot summarizes the document should be reported as indirect prompt injection via untrusted civic document content entering the model context. Unlike direct chat-box injection, the adversarial instructions ride inside retrieved or uploaded paperwork the assistant is asked to trust as data. Municipal copilots that summarize resident documents must treat that content as untrusted and avoid executing embedded directives that alter policy behavior.
Direct prompt injection via privileged system instructions describes an attacker manipulating the system prompt directly, not content smuggled in through a resident's uploaded notes file—here the malicious text arrives as untrusted document data, which is the indirect path. Context window overflow from oversized document content delaying summary output is a performance issue tied to document size, not a payload trying to override policy instructions; a short file with the same override attempt would trigger the identical issue. Training data poisoning via untrusted document content in pretraining corpora would corrupt the model's weights during training—this incident happens at inference time, reading one uploaded file during a live summarization, which is squarely indirect injection rather than poisoning.
Exam caveat: Indirect injection is the label when hostile instructions arrive through documents or RAG rather than the live user prompt, not direct-injection framing, context-overflow issues, or training-time poisoning.
Operational check: reproduce with a benign marker phrase in an uploaded note; confirm the summarizer does not obey override attempts; deploy content filters and strict system-priority instructions; and monitor summarization sessions for policy-override language originating in document text.