Securing Locally Deployed LLM-RAG Assistants: A Cross-Model and Cross-Lingual Evaluation of Indirect Prompt Injection Defenses

Summary

This study evaluates indirect prompt injection against locally deployed RAG assistants, testing four attack families across five defense configurations (C1–C5) and four local LLMs on a synthetic corpus of 40 documents and 32 queries. In the Llama 3.1 8B experiment, conditional Attack Success Rate fell from 70.4% without defenses (C1) to 22.2% with deterministic post-generation filtering (C5). Context contamination remained the main residual weakness, and the authors note the filter and evaluator share some detection indicators, so post-filter ASR reflects unsafe content left in responses.

Mitigation

Deterministic post-generation filtering (C5), which the authors say supports independent security enforcement, reduced conditional ASR from 70.4% to 22.2% in the Llama 3.1 8B experiment and gave post-filter ASRs of 7.4–22.2% across the four models, with Answer Utility ranging from 21.9% to 62.5%.

Topics

• Prompt injection and jailbreaks
• Retrieval-augmented generation

Related items

• InfoeBay appears to have shut the door on third-party AI agentsSame vendor · The Verge (AI)
• InfoEven Martin Scorsese uses AI for storyboards. Can the art survive?Same vendor · The Guardian Technology
• InfoIntroducing Our Smallest, Most Efficient Model: Muse EmberSame vendor · Simon Willison's Weblog
• InfoApple is racing to make Siri more agenticSame vendor · The Verge (AI)
• HighCVE-2026-123974: TorchServe local privilege escalation via predictable /tmp extraction directorySame vendor · NVD/CVE Database