WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2023 • Sep 27, 2023

ChatGPT, ignore the above instructions! Prompt injection attacks and how to avoid them.

Sebastian Schrittwieser

Are your AI system instructions leaking as public knowledge? Traditional filtering fails against prompt injections, but dual LLM architectures can isolate untrusted data and secure your application.

Pause
Mute Enter Fullscreen
#1 about 3 min

Growth of large language models and security awareness

The rapid adoption of artificial intelligence introduces significant security challenges that developers often overlook initially.

#2 about 2 min

Executing basic prompt injection attacks through translation tasks

Conflicting instructions in user input can successfully override a base language model's original operational directive.

#3 about 2 min

Understanding context and system prompts in applications

Defining boundaries between underlying developer instructions and incoming user input helps identify the source of intended model behavior.

#4 about 2 min

Real-world prompt injection attacks on social media bots

Real-world incidents demonstrate how targeted text inputs can easily manipulate an automated bot into generating non-relevant text.

#5 about 3 min

Extracting developer instructions via context leak attacks

Malicious users can force a model to expose its underlying instructions and sensitive logic by exploiting specific query structures.

#6 about 2 min

The inability to secure sensitive information in system prompts

Developers must treat all contextual instructions and system prompts as publicly accessible data since evasion techniques remain unpredictable.

#7 about 4 min

Exploiting external plugins with untrusted input manipulation

Connecting language models to external data sources creates dangerous new avenues for automated injection attacks.

#8 about 3 min

Comparing prompt injection to traditional SQL injection attacks

The fundamental lack of separation between developer code and user input in language models mirrors the mechanics of SQL injection.

#9 about 3 min

Falling short with traditional input and output filtering

Standard security techniques like blacklisting fail against the endless linguistic complexities and encoding methods of natural language prompts.

#10 about 2 min

Assessing the limitations of prompt reordering and confirmation dialogues

Placing user input before the system context or adding strict confirmation dialogues yields inadequate security against determined attackers.

#11 about 4 min

Isolating untrusted data using the dual language model architecture

A structural approach using privileged and quarantined models safely processes potentially malicious external data by enforcing strict separation.

#12 about 2 min

Evaluating ongoing security risks in large language models

Large language models remain highly vulnerable to untrusted input manipulations that override intended application behavior.

#13 about 4 min

Answering questions on prompt intent and data tagging

Exploring alternative defense mechanisms like XML tagging and intent analysis reveals the difficulty of detecting malicious instructions automatically.

Matching moments

2:52 min

Mitigating indirect prompt injection in language models

Jose Manuel Ortega Jose Manuel Ortega · Europe 2026 Virtual

2:46 min

Bypassing language model safeguards utilizing contextual prompt injection attacks

Chris Heilmann +1 · LIVE

5:44 min

Prompt injection vulnerabilities and contextual mitigation testing challenges

Mirko Ross · World Congress 2023

3:04 min

Prompt injections bypassing language model service guardrails

Ramona Schwering Ramona Schwering · World Congress 2026 Europe

2:20 min

Why traditional security fails against large language models

Péter Farkas Péter Farkas · Europe 2026 Virtual

3:29 min

Identifying and defining prompt injection execution vulnerabilities

Mackenzie Mackenzie · World Congress 2024

More from World Congress 2023

The year 3000, a brief history of Web Development thumbnail
25:30
over 2 years ago

The year 3000, a brief history of Web Development

Lorenzo Pieri

Demografie nutzen um jedem Bewerber das passende Angebot zu machen! thumbnail
8:52
almost 3 years ago

Demografie nutzen um jedem Bewerber das passende Angebot zu machen!

Nathalie Gierth

Guided Memory Management: Rust's Ownership Model thumbnail
0:18
almost 3 years ago

Guided Memory Management: Rust's Ownership Model

Stefan Baumgartner

Passwordless future: WebAuthn and Passkeys in practice thumbnail
32:32
almost 3 years ago

Passwordless future: WebAuthn and Passkeys in practice

Clemens Hübner

External Secrets Operator: the secrets management toolbox for self-sufficient teams thumbnail
30:07
almost 3 years ago

External Secrets Operator: the secrets management toolbox for self-sufficient teams

Moritz Johner

Building Reliable Serverless Applications with AWS CDK and Testing thumbnail
25:18
almost 3 years ago

Building Reliable Serverless Applications with AWS CDK and Testing

Raphael Manke

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 25, 2026 · 16:50–17:20

Stage 5

The Things Your AI Isn't Telling You

Desmond Lamptey

Lead Software Engineer at Capital One

Desmond Lamptey
Open session

World Congress 2026 North America

September 25, 2026 · 09:00–09:30

Stage 6

Red Teaming Your LLM App -- A Hands-On Threat Model You Can Reuse

Saloni Garg

Senior ML Engineer at Adobe

Saloni Garg
Open session

World Congress 2026 North America

September 24, 2026 · 16:10–16:40

Stage 3

Sandboxing the Swarm: Building Secure, Serverless AI Agents with Wasm

Thorsten Hans

Sr. Developer Advocate @ Akamai Technologies

Thorsten Hans
Open session

World Congress 2026 North America

September 24, 2026 · 14:50–15:20

Stage 1

The Era of Machine-Driven Defense is Here: Headless Security

Loris Degioanni

Founder & CTO of Sysdig

Loris Degioanni
Open session

World Congress 2026 North America

September 24, 2026 · 16:50–17:20

Stage 5

Context Engineering Kung Fu

Carl Lapierre

Tech Lead and AI Engineer at Osedea

Carl Lapierre
Open session

World Congress 2026 North America

September 24, 2026 · 11:00–11:30

Stage 7

Responsible AI Architecture with Zero Trust Agents

Ashok Prakash

Staff ML Engineer at Apple

Ashok Prakash

Related videos

Manipulating The Machine: Prompt Injections And Counter Measures thumbnail
27:10
World Congress 2024 • about 2 years ago

Manipulating The Machine: Prompt Injections And Counter Measures

Georg

Prompt Injection, Poisoning & More: The Dark Side of LLMs thumbnail
23:24
World Congress 2025 • about 1 year ago

Prompt Injection, Poisoning & More: The Dark Side of LLMs

Keno Dreßel

The AI Security Survival Guide: Practical Advice for Stressed-Out Developers thumbnail
30:36
World Congress 2024 • about 2 years ago

The AI Security Survival Guide: Practical Advice for Stressed-Out Developers

Mackenzie

Using LLMs in your Product thumbnail
31:12
World Congress 2024 • about 2 years ago

Using LLMs in your Product

Daniel Töws

Beyond the Hype: Building Trustworthy and Reliable LLM Applications with Guardrails thumbnail
29:00
World Congress 2025 • about 1 year ago

Beyond the Hype: Building Trustworthy and Reliable LLM Applications with Guardrails

Alex Soto

Hack Me If You Can: Designing Unbreakable LLM Guardrails thumbnail
30:53
World Congress 2026 Europe • 3 months ago

Hack Me If You Can: Designing Unbreakable LLM Guardrails

Cansu Kavili Örnek

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.