# Prompt Injection (LLM-as-Judge)

- **Severity:** Critical
- **Signature ID:** `netzilo-llmjudge-prompt-injection-001`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

This detection uses a secondary AI model to review incoming text and decide whether it contains a prompt injection attempt — text crafted to hijack an AI agent's instructions. If the judge model flags the input as malicious, the system can block it before it reaches the target agent.

## How the attack works

An attacker submits input to an AI agent that contains hidden or overt instructions meant to override the agent's original task, such as 'ignore previous instructions' or embedded commands disguised as data. Instead of relying on fixed pattern matching, this detection sends the input to a separate AI scanner along with a rubric asking it to judge whether the text looks like a prompt injection attempt. The scanner returns a verdict, and if it judges the input to be a clear injection attempt, the system can block it before the target agent processes it.

## Why it matters

If this check is bypassed or fails, an attacker's injected instructions can reach the target agent and potentially manipulate its behavior, leak data, or perform unauthorized actions on the attacker's behalf.

## What you can do

- Do not rely on this as the only defense; treat it as one filter in a layered setup since AI judges can be fooled or fail open if unavailable.
- Review flagged inputs manually periodically to check for false positives, especially content from security research, documentation, or test data.
- Confirm what happens when the AI scanner is unavailable — if it fails open (allows input through), consider making it fail closed for sensitive agents.
- Log and monitor blocked and flagged inputs to spot patterns of repeated injection attempts targeting the same agent or workflow.

## Known benign look-alikes

- Legitimate content discussing the flagged topic (security research, documentation, test data)
- AI scanner unavailable or no AI keys configured (fails open -> allow)

## References

- https://docs.smith.langchain.com/evaluation

---
Source: https://www.netzilo.com/threats/llm-as-judge-prompt-injection