Banana Navy
Catalog FR
Lab · Threat modeling IA · Fiche détaillée

Indirect prompt injection (via transcription, content, inaudible sounds)

content injected through a secondary channel (transcription, fetched content, inaudible payloads in the media, history) drives the model unbeknownst to the user.

SheetF16
CategoryAI2-TB7 (prompt injection indirecte)
Layers9 · STT Transcription, 5 · Audio Normalization, 14 · LLM Interpretation
Systemvoicebot IA

approved, controlled knowledge base and sources, no injectable persistent content, filtering of the audio or voice channel before transcription: the vector stays open as long as the transcription is not filtered.

The threat

content injected through a secondary channel (transcription, fetched content, inaudible payloads in the media, history) drives the model unbeknownst to the user.

Angle mortWhy classic frameworks miss it

non-executable content (text, transcription, sounds) is not seen as a payload; the document-to-context-to-decision chain escapes classic input controls, and a vector inaudible to a human remains a real input for the model.

MitigationProposed approach

approved, controlled knowledge base and sources, no injectable persistent content, filtering of the audio or voice channel before transcription: the vector stays open as long as the transcription is not filtered.

The proposed control
no injectable persistent content; channel filtering before transcription.

Expected evidence
a secondary-channel injection never reaches the decision path.

SourcesReferences and public research

MITRE ATLAS 2026.07AML.T0051.001 Indirect
OWASP GenAIOWASP GenAI LLM01:2025 Prompt Injection
Recherche publiquePublic research sources: MITRE ATLAS 2026.07 (verified technique mapping), OWASP GenAI (OWASP), and the public risk-voicebot (aivansoul/risk-voicebot) template defining the 20 checkpoints. No client registry data: generic sheet, no rating, no verdict.
couche 9 · STT Transcriptioncouche 5 · Audio Normalizationcouche 14 · LLM Interpretation

Explore the 20 security layers

MITRE ATLAS 2026.07 · OWASP GenAI · risk-voicebot