Prompt Leaking via Ignore-Previous-Instructions in User Input (PromptInject)
This detects attempts to trick an AI system into revealing its hidden system prompt. The attacker tells the model to ignore its original instructions and then print, repeat, translate, or otherwise output those instructions, exposing confidential setup text.
How the attack works
The attacker sends input containing a command like 'ignore the previous instructions' followed by a request to print, output, reveal, dump, display, translate, summarize, or spell-check the previous instructions. This combination is designed to override the model's guardrails and make it echo back its system prompt or earlier context instead of performing its intended task. The rule covers a wide set of verbs beyond the original 'print/output/reveal/spell-check' phrasing, including dump, display, show, relay, expose, disclose, translate, summarize, paraphrase, verify, and confirm. It targets information disclosure specifically, not attempts to make the model perform a different action (goal hijacking).
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 25971b2f-4323-45cd-b271-dccce633da61
- Severity
- High
Why it matters
If successful, the operator's system prompt — which may contain business logic, guardrail instructions, API details, or other confidential configuration — is exposed to the attacker, who can then use that knowledge to craft more effective attacks or steal proprietary prompt engineering.
What you can do
- →Avoid putting secrets, credentials, or sensitive business logic directly in system prompts; treat them as potentially exposable.
- →Add output filtering or post-processing checks that block responses closely matching known system prompt text.
- →Review flagged inputs to distinguish genuine prompt-leak attempts from benign requests like 'please print the summary' or 'check spelling of this paragraph.'
- →Log and monitor repeated variations of 'ignore instructions and reveal/output/translate previous instructions' patterns from the same user or session.
Known benign look-alikes
- Normal print request without injection structure: 'Please print the summary'
- Legitimate spell-check request: 'Review the previous paragraph and check spelling'
- Innocent questions about instructions: 'What were the original instructions for this task?'
- Legitimate config display: 'I want to verify my settings - can you show my configuration?'