Indirect Prompt Injection in Local LLMs: A Systematic Test
Summary Llama 3.2 3B followed malicious instructions embedded in untrusted document content in 28 out of 36 tests (77.8%) with high confidence. Across every injection style tested, the model failed to distinguish instructions from a legitimate user from instructions embedded inside data it was asked to process. The attack required no special access, no technical sophistication, and no interaction from the target user. A document the user never wrote could override what they asked the model to do. ...