UCLA

Retrieval-Augmented Generation (RAG) systems that invoke external tools introduce a new attack surface: indirect prompt injection, where malicious instructions are embedded in retrieved documents rather than the user’s input. This thesis empirically evaluates four mitigation strategies—prompt-level defense, rule-based sanitization, tool-use restriction, and attribution gating—applied individually and as a full stack, against five attack types across three large language models (Claude Sonnet 4.6, GPT-4o, GPT-3.5-turbo) in a controlled 17,278-run experiment.The full mitigation stack reduces the attack success rate from 40.6% to 0.2% while preserving benign utility (90.6% to 90.2%) and improving latency. Among individual layers, rule-based sanitization is the strongest (3.2% ASR) while attribution gating provides negligible protection (40.9%). We introduce a novel attack category, information pollution (A5), in which the sentinel value is embedded as factual domain data rather than an imperative instruction. A5 achieves 77.5% ASR at baseline and is the hardest attack to block. Paradoxically, Claude Sonnet—the most resistant model to instruction-based attacks (as low as 0% on A3/A4)—is the most vulnerable to A5 (approximately 95%), revealing a systematic blind spot in safety training. Adaptive attacks provide only marginal uplift (≤3.7 percentage points) over naive variants across all configurations.