Overview
BIPIA was presented as the first benchmark dedicated to indirect prompt injection: instructions hidden in content that an application passes to the model, such as emails, web pages, tables or code, rather than typed by the user.
| Field | Value |
|---|---|
| Resource type | Benchmark |
| Original title | Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models |
| Authors | Jingwei Yi, Yueqi Xie, Bin Zhu, Emre Kiciman, Guangzhong Sun, Xing Xie, Fangzhao Wu |
| First public version | 2023-12-21 |
| Publication status | Available on arXiv (arXiv:2312.14197); the arXiv entry states it was accepted by KDD 2025. |
| Focus areas | Indirect injection, Evaluation, Defenses |
| Artifacts | microsoft/BIPIA (GitHub) |
| Last reviewed | 2026-09-26 |
Research question
How vulnerable are LLMs to instructions embedded in external content, why do such attacks succeed, and can relatively simple defenses reduce the risk without degrading output quality?
Method and artifact
The benchmark pairs benign user tasks over external content with attacker instructions inserted into that content and measures whether model outputs deviate from the user's intent. The authors then evaluate two proposed defenses: boundary awareness and explicit reminders, in black-box (prompting) and white-box (fine-tuning) variants. Attack categories are described here only at a conceptual level.
- microsoft/BIPIA (GitHub) - official repository; archived and read-only, so it is no longer actively maintained
Key findings reported by the authors
Source statements: the points below summarize what the cited publication reports for the models and configurations it tested.
- The evaluated LLMs were found to be universally vulnerable in the benchmark.
- The authors identify two contributing factors: difficulty distinguishing informational context from actionable instructions, and a lack of awareness that instructions inside external content should not be executed.
- The black-box defense reportedly provides substantial mitigation; the white-box defense reportedly reduces attack success to near zero in their experiments while preserving output quality.
Security interpretation
Site interpretation: this section is Prompt-Injection.net's explanation of why the work matters, not a claim made by the authors.
BIPIA gives empirical backing to techniques this site describes as spotlighting and data marking. The near-zero white-box result is a result for the tested models, attacks and metrics; it does not make marking a deterministic boundary, which is why it should be combined with authorization and output controls.
Limits and caveats
- All model numbers are historical results for the models and configurations tested; they are not claims about current models.
- A benchmark with a fixed attack set can overstate robustness against adaptive attackers.
- The official GitHub repository is archived and read-only as of September 2026. This is an artifact-maintenance note, not a criticism of the paper.
How to use this work
Use BIPIA to understand how indirect injection is operationalized as a measurable task and as a baseline reference when evaluating content-marking defenses. If you reuse the archived code, expect to maintain dependencies yourself.
Related content on Prompt-Injection.net
- Indirect Prompt Injection - How external content can carry instructions into an AI system.
- Email Prompt Injection - How inbound email becomes model-visible content in AI mail workflows, why sender authentication is not instruction authority, and how to bind authorization to the exact action.
- Source Code Prompt Injection - How repository content and designated instruction files reach coding assistants, influence plans and edits, and require provenance and deterministic authorization.
- Spotlighting / Data Marking - How system-controlled marking, delimiting, transformation and channel separation make untrusted external content more recognizable to a model. One defense layer against indirect prompt injection, not a trust upgrade or authorization boundary.
- Input / Content Inspection - How to inspect user input and external content for prompt injection risk signals: inspection points, representations, risk-tiered dispositions, failure behavior and metrics. An inspection result is evidence, not a trust or authorization decision.
- Trust Boundaries and Model Context - What model-visible context is, why position does not create trust, and why controls sit outside the model.