Key Questions for Secure Deployment of Large Language Models

The OWASP Top 10 for LLM applications highlights two primary prompt injection categories: direct and indirect. Direct injection involves unauthorized overwriting or revelation of system prompts, while indirect injection targets external inputs that attackers can manipulate to influence user prompts. Both represent critical attack surfaces in any LLM deployment.

In indirect prompt injection, an attacker manipulates external input fed into the LLM to alter its behavior or outputs. Mitigating this requires controls that sanitize or segregate untrusted content, limit its influence on user prompts, and ideally surface visual indicators to users when a response may originate from potentially untrustworthy sources.

LLM deployments should enforce least-privilege access to backend systems and extensible functionalities, ensuring plugins operate only within defined permission scopes. User approval mechanisms for privileged operations are also recommended, reducing the risk that a compromised or manipulated LLM can execute high-impact actions without explicit human authorization.

Effective runtime monitoring of LLMs involves continuously observing model behavior for suspicious activity or indicators of an active attack. This should be combined with regular security testing — including penetration testing and code review — specifically targeting prompt injection vulnerabilities to ensure issues are identified and remediated before they are exploited.

Trust boundaries define which inputs, systems, and data sources an LLM is permitted to interact with and to what degree. Without clear boundaries between the model, external content sources, and extensible functionalities, attackers can exploit those junctions to inject malicious instructions or escalate privileges, making boundary enforcement a foundational element of LLM security architecture.