Indirect Prompt Injection via Document Upload (ATK-003)

Prerequisites

Target system accepts user-uploaded documents (PDF, Office, plain text) for summarization, Q&A, classification, or task automation.
Document contents are passed into the model context with limited or absent sanitization of instruction-style text.

Test approach

With written authorization, the tester uploads documents containing embedded adversarial instructions in body text, metadata fields, comments, footers, embedded images (with steganographic or OCR-extractable text), or invisible characters. The tester observes whether the model follows the embedded instructions — for example, to reveal system prompt, ignore user-supplied instructions, redirect responses, or invoke tools.

Expected evidence

Uploaded documents with hashes and timestamps.
Model context payload showing the document content as ingested.
Model output demonstrating compliance with injected instructions.
Cleanup of any uploaded test artifacts.

Detection signals

Documents whose extracted text exceeds typical document size for their visible content.
High instruction-token density in uploaded documents.
Tool invocations triggered immediately after document processing.
Outputs whose structure suggests the model summarized instructions rather than content.

Defensive recommendations

Sanitize uploaded documents before model ingestion: strip metadata, normalize whitespace, remove non-printable Unicode.
Use structured ingestion that explicitly marks document text as untrusted retrieved content rather than user instruction.
Constrain tool authorization for sessions where uploaded documents are present.
Include document-upload PI test cases in pre-production evaluation.

Framework mappings

OWASP LLM Top 10: LLM01:2025, LLM02:2025
OWASP Agentic Top 10: AAI01
MITRE ATLAS: AML.T0051
NIST AI RMF: MEASURE-2.7

Related AI Controls Catalog entries

These controls provide the audit test procedures that validate defences against this attack pattern.