How would you defend a RAG system against prompt injection through retrieved documents?
- 1 min — define indirect injection; data vs instructions.
- 3 min — layered defences.
- 2 min — least privilege and blast radius as the real control.
- 1 min — trust tiers by source and continuous red-teaming.
Indirect prompt injection: an attacker plants instructions in a document that will be retrieved, and the model follows them. The core principle is that retrieved content is data, never instructions, and since no prompt can fully guarantee that separation, the defence must be architectural rather than textual.
Layered defences:
- Structural separation: clearly delimited context blocks, with a system prompt stating that content inside them is untrusted data.
- Ingestion scanning: flag documents containing instruction-like patterns or hidden text (white-on-white, zero-width characters, HTML comments) before they're indexed.
- Output constraints: structured output, allowlisted actions, no raw markdown links or images in responses — a rendered image URL is a classic exfiltration channel.
- Least privilege on tools: this is the one that matters. If the model can only read, injection is a quality problem. If it can send email or call APIs, injection is a breach.
- Human confirmation for any consequential action.
Reason about trust boundaries by source: your own curated corpus is one risk profile, user-uploaded documents a second, web-scraped content a third. Apply controls accordingly instead of uniformly. Then state the limit honestly — "no filter catches every injection, so I design assuming one gets through, which means the blast radius of a compromised generation step has to be bounded by permissions, not by prompting."
Org scope: security owns the threat model and red-team suite; the platform owns output sanitisation and tool permissions as shared middleware. Classifier-based injection detectors can be bought, but treat them as one layer that reduces volume, never as the control.
What the answer sounds like at each level
Tell the model in the system prompt to ignore instructions in documents and scan documents for suspicious text.
Layers delimiting, ingestion scanning, output constraints, least-privilege tools and human confirmation, and knows prompt-level defences are not sufficient.
Designs assuming injection succeeds — bounds blast radius by permissions, breaks the private-data + untrusted-content + exfiltration-channel combination, and tiers controls by content source.
Follow-ups the interviewer will push
1The assistant can now send email on the user's behalf. What changes?
It now combines private data, untrusted content and an exfiltration channel — Willison's lethal trifecta. Require human confirmation of recipient and body for every send, restrict recipients to the user's organisation by default, and never let retrieved text populate the recipient field.
2How would you test this continuously?
A red-team corpus of injection documents (hidden text, markdown image exfiltration, tool-call instructions) seeded into a staging index, with CI tests asserting no tool call, link or image is produced from them. Expand it from every new public technique and every incident.
Red flags interviewers listen for
- Relies on the system prompt alone.
- Allows raw markdown images or links in rendered output.
- Gives the model write tools without confirmation.
How it's scored
| Dimension | What strong looks like |
|---|---|
| Threat model | Understands indirect injection and exfiltration channels. |
| Architecture | Bounds blast radius with permissions rather than prompts. |
| Honesty | States that no filter catches everything and designs for that. |
Sources
- Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — Greshake et al., 2023paper
- The lethal trifecta for AI agents — Simon Willison, 2025blog