Skip to main content
https://myllmdoc.com/ This challenge is to experiment with multi-chain prompt injection.
To improve the reliability and performance of LLMs, one of the important prompt engineering techniques is to break tasks into its subtasks. Once those subtasks have been identified, the LLM is prompted with a subtask and then its response is used as input to another prompt. This is what’s referred to as prompt chaining, where a task is split into subtasks with the idea to create a chain of prompt operations.
L1 Avi In response to the consultation we are provided with an AI debug trace, which we can use the processes that the multi-chain LLM is using
It performs 4 actions
  1. normalize_query
  2. route_query
  3. extract_symptoms
  4. AdvisorSimpleReactAgent

Flag 1

For the prompt injection attack to work here we need to bypass the restrictions for each of the above actions in the multi-chain LLM.
  • normalize_query : prevent it from modifying the malicious input
  • route_query : should not get rejected but redirected to symptomadvider route
  • extract_symptoms : need to include the malicious input in the symptoms json
  • AdvisorSimpleReactAgent : the part for which the malicious input to exfiltrate info from
We’ll start bypassing each of these steps by forcing the LLM enter an admin debug mode and making it follow the instruction specifically entered in that mode.
  1. Bypassing route_query
L2 Pn
  1. Bypassing extract_symptoms
  1. Exfiltrating from AdvisorSimpleReactAgent
and in response to it we get the flag 2 Avi

Flag 2

21 Avi

Flag 3

I tried different way to get the user’s profile but it kept removing the malicious prompt in the 3rd action (extract_symptoms). To bypass these restrictions, I prompted it encode the output when returning the information.

Flag 4 (Bonus)