Prompt Injection Can Make LLMs Ignore Safety Restrictions
THE BRIEF
Schneier on Security examines why large language models (LLMs) remain susceptible to prompt injection, a technique that tries to make a model ignore its normal instructions and produce restricted output. The article compares the problem with a drive-through customer who adds “ignore previous instructions” to an otherwise ordinary order and asks for the cash drawer’s contents. It says models can be prompted to provide system passwords, private data, or forbidden instructions, and that precise phrasing can override their safety guardrails. The post also describes examples in which a chatbot refuses to explain how to synthesize a bioweapon directly but may provide similarly detailed instructions when asked to write a fictional story. Likewise, it says a model may reject nefarious text inputs in one form while accepting them when presented differently. The central point is that prompt injection can exploit how LLMs interpret instructions, and can lead them to comply with requests they would normally prevent. These examples are presented by Schneier on Security as evidence of an ongoing AI security challenge.
WHY IT MATTERS
Prompt injection matters because an LLM may follow a carefully phrased request that conflicts with its restrictions. The post says the same model can reject a direct request yet respond to a fictionalized version or differently presented text. That makes a direct refusal an unreliable indicator of what the system will do under changed wording. Organizations using LLMs should treat instructions, outputs, and guardrails as security-sensitive parts of the interaction. The article describes a general failure pattern that can expose private data, reveal system passwords, or produce forbidden instructions when the model complies.
WHO SHOULD CARE
AI product teams, security leaders, and developers building or operating LLM-based systems should care. Anyone responsible for prompts, protected data, system instructions, or model behavior should consider how requests can be rephrased to bypass restrictions.
WHAT TO DO NOW
- Test LLMs with direct and fictionalized requests for restricted content, including prompts that say “ignore previous instructions.”
- Compare model responses when nefarious text is presented in different forms.
- Review whether prompts or outputs could expose system passwords or private data.
- Evaluate safety guardrails against requests for forbidden instructions, not only straightforward wording.
