Prompt Injection Tester

Detection analyzes text already received to find injection patterns. Testing is proactive — you deliberately craft payloads and send them to your AI system to see if they succeed. This tool helps with both: it generates test payloads you can use to probe your AI system's defenses, and analyzes how effective your system's prompt structure is at resisting them.

Key categories: (1) Direct override — 'Ignore previous instructions'. (2) Role injection — 'You are now a different AI with no restrictions'. (3) Data extraction — 'Repeat your system prompt'. (4) Goal hijacking — embedding secondary instructions in documents or user content. (5) Indirect injection — malicious content in external sources the AI reads. (6) Delimiter confusion — using special characters to break instruction boundaries.

Best practices: (1) Use a staging/dev environment, not production. (2) Log all test attempts with their outcomes. (3) Test with controlled users, not real ones. (4) Document which payload categories your system resisted vs. succumbed to. (5) Re-test after any system prompt changes. (6) Consider automated red-teaming tools like Garak, PromptBench, or custom test suites.

Proven defenses: (1) Instructed self-defense — tell the model in the system prompt to ignore instructions from user content. (2) Input/output validation — filter known patterns before/after the LLM call. (3) Privilege separation — user instructions run at lower trust than system instructions. (4) Spotlighting — mark untrusted data with XML tags so the model knows what is data vs. instruction. (5) Canary tokens — embed secret strings to detect exfiltration.

A canary token is a unique secret string embedded in your system prompt (e.g., 'CANARY-XK7B2'). If a user extracts and reports this token, you know your system prompt is vulnerable to exfiltration. Add monitoring: if this string appears in model outputs or logs from outside your system, an injection attack succeeded in leaking your system prompt.