[Emerging Technologies and Threats] Which of the following AI concerns is most adequately addressed by input sanitation?

Prompt injection is an attack technique that involves crafting malicious inputs to manipulate a Large Language Model (LLM) into performing unintended actions, such as ignoring previous instructions or revealing sensitive information. This attack fundamentally exploits the model's input processing channel. Input sanitation, a security control that involves filtering, validating, and cleaning user-provided data before it is processed, is a direct and primary countermeasure. By sanitizing the prompt, a system can attempt to remove or neutralize the malicious instructions, thereby mitigating the risk of the model being compromised by the injected content.

A. Model inversion: This is a privacy attack that reconstructs sensitive training data by repeatedly querying a model. It is mitigated by techniques like differential privacy, not primarily by input sanitation.

C. Data poisoning: This attack corrupts the model's training dataset to compromise its integrity. It occurs during the training phase, whereas input sanitation is applied during the inference (user interaction) phase.

D. Non-explainable model: This refers to the "black box" nature of complex AI, where it is difficult to understand its decision-making process. This is an inherent characteristic, addressed by Explainable AI (XAI) methods, not input controls.

---

1. OWASP Foundation. (2023). OWASP Top 10 for Large Language Model Applications. LLM01: Prompt Injection. This document identifies prompt injection as the top vulnerability for LLMs and lists "input validation and sanitization" as a key mitigation strategy. It states

"Implement robust input validation and sanitization to limit adversarial input."

2. NIST. (2023). Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations. NIST Special Publication 800-218A (Draft). This publication categorizes prompt injection as a type of evasion attack that manipulates inputs at inference time. Section 4 discusses defenses

including input sanitization

as a method to defend against such input-based attacks.

3. Parno

B.

et al. (2023). Living with the Trickster: A Foundational Perspective on AI/ML Trust and Safety. Stanford University

Center for Research on Foundation Models (CRFM). The paper discusses LLM vulnerabilities

including prompt injection

framing it as an input-based security problem where the model is tricked by crafted prompts

reinforcing that input control is the relevant defense domain.