Basic prompt injection attempts failed or were detected: instruction manipulation alone failed in all 9 iterations, role-playing without concealment was detected in output, and metadata-hidden injections failed in all 9 iterations¶
Claim · All claims
Evidence · 1 study · causalr1·q2
Currency · newest study 2026 · not yet checked against its sources · not reviewed by a person · recheck by 2029: tool and model accuracy changes quickly
Subclaims¶
Reading the evidence codes
q is the design tier, i the impact, n the sample, and the kind with its r
the rigour judged within that kind: what each code means.
This claim: no standardized effect is recorded in observations/ for it yet, so no benchmark reading is possible.
q2 i? Attempt 1 (instruction manipulation only) failed in all 9 iterations, with Copilot disabling the chat without reporting the attempt; attempt 2 changed the grade but referenced the hidden injection in its output; attempt 4 (metadata-hidden) failed in all 9 iterations. → Niklas Humble 2026
Evidence¶
Niklas Humble 2026¶
Niklas Humble. (2026). Ethical Implications of Prompt Injection in AI-mediated Grading: An Adversarial Red-Team Evaluation. Journal of Academic Ethics. https://doi.org/10.1007/s10805-026-09758-9
q2 · i? · causal · r1
Adversarial evaluation attempt 4: injections hidden as file comments, split between metadata and document end, and as html comments all failed; "all prompt injections failing". Copilot graded fail (U) with no mention of the attempts. Attempts 1 and 2 also failed per the Results section.
"In total, 9 iterations were made at hiding the prompt injection in different parts of file metadata, with all prompt injections failing"
Discussion¶
Related Claims¶
- A revised injection combining instruction manipulation and role-playing with an explicit do-not-mention instruction succeeded in all 9 iterations across docx, pdf, and htm formats — related
- Indirect prompt injections combining instruction manipulation, role-playing, and obfuscation altered AI-assigned grades with attack success rates of 94–100% while remaining undetected — related
- Copilot's detection of one advanced injection did not persist: after reporting an embedded instruction once, the same file's injection succeeded in six subsequent iterations without warning — related
- Asking the AI tool directly about hidden instructions exposed the prompt injection in all 6 security-check iterations, but the authors caution this is not a robust safeguard — related
- Deterrence layers failed because seeds changed parameters rather than task structure, scaffolding exposed solution steps, and hidden grading verified output consistency rather than authorship or understanding — related
Page metadata
| Field | Value |
|---|---|
type |
claim |
id |
basic-and-metadata-injections-fail |
title |
Basic prompt injection attempts failed or were detected: instruction manipulation alone failed in all 9 iterations, role-playing without concealment was detected in output, and metadata-hidden injections failed in all 9 iterations |
description |
Basic prompt injection attempts failed or were detected: instruction manipulation alone failed in all 9 iterations, role-playing without concealment was detected in output, and metadata-hidden injections failed in all... |
status |
review |
evidence_strength |
moderate |
newest_evidence |
2026 |
recheck_by |
2029 |
generated |
by process:wiki-ingest on 2026-10-11 |
trust |
unverified — no one has confirmed this page's content |
sources |
1 — niklas-humble-2026 |
Frontmatter is the page's machine-readable record — see the Schema & Guide.