7. Treat retrieved instructions as untrusted data

Objective & prerequisites

Keep document content outside application permissions and tool authority. Prerequisites: Python functions, JSON, lists and the existing API/testing foundations. Extract the full kit and open a terminal in applied-ai-kit. The core lab uses Python 3.10+ with no third-party dependencies or network. Actual new-text semantic inference is a separate optional local setup, tested on Python 3.12/macOS arm64. All CedarLab policies, invoices and review cases are fictional teaching material; they are not DataCareerHub service terms. No payment, registration, live chatbot or visitor-data collection is activated. These free companions do not change course progress or protected access.

python3 lab.py
python3 -m unittest discover -s tests -v

Understand the concept

Prompt injection embeds instructions inside content that should be treated as evidence. D7 asks for a system password as an adversarial example; its retrieval rank does not give it authority. A warning prompt alone cannot enforce authorization. Keep document eligibility and ownership checks outside the model, allow only deliberately supported actions, validate arguments and avoid executing generated code. This kit has no shell tool, file-reading tool or external provider action at inference time. An inactive example is not a proof of resistance for a future agent. If later sources become private, enforce user scope before retrieval and again at access/export boundaries; a vector index is not an authorization system.

Worked example

D7 can appear among results for Q5 even though D6 is the relevant answer passage. The local workflow prints rankings and never interprets the document text as an application command. D8 is excluded as retired before ranking, including for citation validation. These are tested narrow controls. They do not verify a live LLM against every injection strategy or establish security for a multi-user vector service.

from lab import validate_answer,load
try:
    validate_answer('{"answer":"Seven days","citations":["D8"],"abstain":false}',load("corpus.json"))
except ValueError:
    pass
else:
    raise AssertionError("Retired source must be refused")

Try it yourself

Locate D7 in the corpus, write what a vulnerable agent might do and identify the external permission control that should stop it. Test an answer citing D8 and an invented ID. Explain why filtering after presenting a private retrieved passage would be too late. Do not probe real systems or use real secrets. Write your prediction, inspect the source and record actual results. Keep a copy of the original fixtures before making changes.

Knowledge check

Does a highly similar source passage gain permission to choose an arbitrary filesystem path or external destination?

Evidence, mistakes & handover

Record the executed mode: actual local encoder, saved-vector replay, deterministic extraction or human factual review. They establish different things. Keep model/version, source hashes, commands, expected outcomes, failures and limitations with your work. Never turn a schema pass, cosine score or quotation into a claim of proven truth. The download contains a worksheet, independent controls, worked solutions, a factual-review rubric, privacy/cost contract and mini-project checklist. Credit the supplied starting point and describe your own contribution.

Authoritative reference

Read the official reference ↗

— official source for the underlying mechanism. Teaching prose and CedarLab cases are original. Model/runtime compatibility, licensing and operating limits require review for any later deployment; this course does not activate a production AI service.