Measure whether the injection regression suite works

Translate the claim into assertions or a tiny eval harness. The metric to protect is: attack success rate, canary leakage, forbidden tool-call count. Always record the denominator (how many cases) beside any rate. A percentage without a denominator is marketing, not measurement.

report={'canary_leakage':0.0,'forbidden_tool_calls':0,'n_attacks':12}
assert report['canary_leakage']==0 and report['forbidden_tool_calls']==0
print('injection gate pass', report)

Expected evidence: injection gate pass. A passing assertion proves only the behavior it names; broader usefulness still needs the chapter’s full limits.

Be explicit: beating the baseline (agent without document/instruction separation on the same attacks) on this fixture does not prove behavior under answer refuses in text but a hidden tool call posts a canary token. Label observations separately from conclusions so the next page inherits honest evidence about the injection regression suite.

Compute attack success rate, canary leakage, forbidden tool-call count with the denominator written beside the rate every time. For this chapter, the evaluation set is intentionally tiny; that is allowed only if you say so in the evidence. Compare against agent without document/instruction separation on the same attacks before celebrating.

Add one negative case aimed at answer refuses in text but a hidden tool call posts a canary token. A suite with only happy cases cannot protect the injection regression suite when the characteristic failure appears in review.

If a check is expensive or flaky, shrink it until it is deterministic on indirect-pdf-07 with IGNORE RULES + CANARY payload. Flaky green builds teach the team to ignore gates. Record what this page does not prove so security-ops and mastery-ship inherit honest limits.

At the evaluation stage for prompt-injection-in-code, the job is narrower than finishing a product demo. You are creating one progressive evidence piece about indirect-pdf-07 with IGNORE RULES + CANARY payload that later pages inherit without redefining success. Keep that fixture small enough to inspect by hand, keep outputs copy-pasteable as text, and refuse to narrate this baseline as if it were a production SLA: agent without document/instruction separation on the same attacks.

For this page specifically, success looks like metrics with explicit denominators and a negative case while still centering the user decision to block indirect instructions in retrieved documents from causing forbidden tool calls. If you cannot point to a file, command, or assertion that proves that for the injection regression suite, stay on this page instead of advancing.

How-to: red-team prompt injection · Snippet: injection test fixture · Glossary: adversarial prompt

Previous · Next