MAPID / indirect injection / map-reduce

Quarantine by fragment

External content never reaches the Coordinator's planning context intact. It is split into fragments, each processed by a worker that can see nothing else, and only sanitized extractions are recombined. An instruction planted in one fragment has nowhere to travel.

The mechanism

One poisoned fragment, six isolated workers

Pick which fragment carries the injected instruction, then step through. Each worker runs against a single fragment with no access to the Coordinator's plan and no access to any other fragment.

Injection in
Step
clean fragment fragment carrying the injection isolation boundary
What a worker does

Three operations, then it forgets

01

Extract

A sandwich-formatted override prompt asks the worker to pull whatever bears on the user's question, describing any instructions factually rather than executing them.

02

Flag

Text that looks addressed to a model rather than to a reader is marked, following the taxonomy of imperative overrides, system-prompt impersonation, and Unicode-tag or homoglyph encoding.

03

Return a sanitized record

Only the extracted content and the flag set leave the worker. The Coordinator aggregates those records and never re-introduces the original document text, which is context minimization at the document layer.

Deployed configuration: 250-character chunks aligned to sentence boundaries, Llama 3.1 8B Instruct at INT4 for both Map and Reduce.

The real finding

It fails where the Guards succeed, and the reverse

Judged ASR by BIPIA category, perimeter Guards against Map-Reduce. The crossover is the strongest argument in the chapter for running both.

The mechanism behind the split: the Guards catch attacks whose injected instruction is still syntactically visible at the perimeter, which is why reversed text and ciphers die there. Map-Reduce catches attacks hidden inside a transformation request the Guard reads as a legitimate user task, which is why emoji substitution and translation die at the data layer instead. Chunking preserves a reversed or enciphered instruction intact inside a fragment, so the worker sees exactly what the Guard already saw.

Cost and limits

What it buys and what it charges

ConfigurationBIPIA judged ASRInjecAgent judged ASRFallback rateP50
No defense0.5210.659n/a3.13 s
Perimeter LLM Guards0.0490.009n/a7.18 s
Map-Reduce v20.0340.2120.3073.66 s

On InjecAgent it is much worse, and the reason is legible

0.212 against the Guards' 0.009. InjecAgent's injections are directly imperative, of the "wire five thousand dollars to this account" kind, and those are more sensitive to how strict the Map prompt is. The softened v2 prompt admits a fraction of them. BIPIA's content-framed prose is the surface this defense was built for.

Roughly three in ten answers come back empty

A 0.307 fallback rate means the Reduce step returned the no-information response that often. That is a real utility cost, not a rounding error, and it is the price of a worker that refuses to act on anything it cannot ground in the user's question.

Isolation mitigates instruction-data confusion, it does not remove it

The override prompt still depends on the worker model distinguishing its structured task from an embedded directive, and the BIPIA authors show that distinction leaks partial compliance even when the override is in force. Per-fragment isolation bounds the blast radius; it does not make a worker immune.

Evaluated with the perimeter Guards disabled so the numbers report Map-Reduce's own contribution rather than a stacked effect. Full BIPIA enumeration at 3,750 instances and the full InjecAgent test set at 1,054.