Layers: wrapper, detector, output check
The detector is a phrase list, which a determined author can phrase around. The output check does not depend on how the order is worded.
A retrieved passage is text somebody else wrote, and it can contain sentences that look like orders to the model. Treat retrieved text as data, never as commands, and defend in layers because no single layer is enough.
Change the code and press Run (Ctrl+Enter). Predict what will happen first, then break it on purpose and read what changes. Your edits are saved and match the lesson page.
Ready for more? This phase has 6 hands-on exercises with automatic checks.
Practice questions
Write the code in the editor, run it, then open the model answer to compare.
Write looks_like_orders(text, phrases) that returns True when any phrase appears in the lower-cased text. Test it on the planted passage and on the refunds passage.
Write output_ok(answer, sent_ids) that returns True only when the answer contains a citation such as [D2] for at least one sent id. Test it on "Shops close at 6 pm. [D2]" and on "banana".
Explain it without notes
What is indirect prompt injection, and why is it a bigger concern for RAG than for a plain chatbot?
Why are delimiters and a rule in the system prompt not enough on their own?
Name four layers of defence and say what each one contributes.
How would you test, in CI, that your system resists an instruction hidden in a document?
Expected output
no defences -> banana
wrapper only -> banana
wrapper + output check -> I can't answer that from the handbook.
wrapper + detector -> Shops open at 7 am and close at 9 pm every day. [D2] (quarantined: X1)
all three -> Shops open at 7 am and close at 9 pm every day. [D2] (quarantined: X1)