Indirect Prompt Injection Is a Data-Flow Problem

Most discussions of prompt injection focus on filtering hostile strings. That framing underperforms because the injected instruction and the legitimate instruction arrive through the same channel with the same authority — the model cannot reliably distinguish them by form alone.

The more productive frame is a data-flow question: which sources are untrusted, where do they enter the context, and what authority does the model hold once they do?

Retrieval pipelines make this concrete. A document that was safe when indexed may contain instructions that execute when retrieved months later. Web pages, tickets, emails and user uploads are all the same pattern: untrusted content flowing into a privileged context.

Assessment therefore follows the flow. Map every source, classify trust, examine what the model can do downstream — tools, queries, rendering — and then test whether content from a low-trust source can influence a high-trust action. The mitigation that follows is architectural: scoping, isolation and authorization at the tool layer, not a better blocklist.