Reproduce “System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Fangzhou Wu, Ethan Cecchetti, Chaowei Xiao
The f-secure LLM system introduces a system-level defense against indirect prompt injection attacks by implementing Information Flow Control principles to isolate an LLM's planning component from untrusted data. This architecture achieved a 0% attack success rate against such attacks in evaluations, outperforming other architectural defenses, and is formally proven to prevent untrusted information from compromising execution traces.
Key insights
- Indirect prompt injection can be mitigated by architecturally separating the LLM's planning function from any untrusted data.
- Information Flow Control (IFC) offers a principled and provable method to track and enforce security policies on information flow within LLM-based systems.
- Standardizing the LLM's execution plans into a Structured Executable Planning Format (SEPF) enables precise security monitoring and enforcement.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.