Prompt injection scanners should be positional, not phrasal (attest.rta.lat)

A new enhancement in prompt injection detection, proposed by the developers of the tool "attest," emphasizes the importance of positional context in analyzing strings rather than treating all inputs uniformly. The tool identifies and classifies JSON fields based on their roles—distinguishing between fields that carry meaningful results and those that serve metadata or instructions. This approach significantly alters how potential prompt injections are flagged, escalating the severity of injections found in instruction-relevant fields while maintaining a lower severity for those in result-carrying fields. For example, the same string in a description yields a critical flag, whereas the identical phrase in a content field does not escalate. This innovation is crucial for the AI/ML community as it adds a nuanced layer to the detection of prompt injections, enhancing security against misuse while advancing methodologies for AI model safety. By encoding positional rules alongside signature-based detection methods, the system aims to reduce false positives and ensure that serious threats are appropriately prioritized. However, the creators acknowledge that their approach has limitations, such as its reliance on finite regex signatures, highlighting the need for continuous evaluation in the face of evolving tactics from potential adversaries.