Exercise 02 Prompt Injection Threat Model

# exercise-02: Prompt Injection Threat Model

**Estimated effort:** 4 hours

## Objective

Produce a **STRIDE-style threat model for prompt injection** against a retrieval-augmented (RAG) agent, with explicit focus on **indirect injection** (OWASP LLM01:2025). You will enumerate the injection paths, rate each by impact and likelihood, map every threat to a structural control, and prove the residual risk is contained — not merely "the model was told not to obey."

## Background

This exercise covers material from:

- [Chapter 2 — Prompt Injection: LLM01 and the Indirect Threat](../02-prompt-injection-llm01.md)
- [Chapter 6 — Untrusted-Content Segregation and Adversarial Testing](../06-untrusted-content-and-red-teaming.md)

The system to model: a **research assistant agent** that answers user questions by retrieving from (a) an internal document store, (b) live web search, and (c) the user's own uploaded files. It can `web_search(query)`, `fetch_url(url)`, `read_uploaded_file(file_id)`, and `send_summary_email(to, body)`. The deliverable is a threat model document plus a data-flow diagram — design, not code.

## Prerequisites

- Familiarity with data-flow diagrams and trust boundaries.
- The privilege-of-content principle from Chapter 2.

## Tasks

### 1. Data-flow diagram with trust boundaries

- Draw a `text` data-flow diagram showing user input, each retrieval source, the model, the tools, and the email egress.
- Mark trust boundaries. Explicitly label which data sources are **attacker-controllable** (web pages, uploaded files, and — argue it — the internal store too).

### 2. Enumerate injection paths

- For each untrusted source, write at least one concrete **indirect injection** scenario (e.g., a planted web page that instructs the agent to email the user's documents to an attacker).
- Include one **direct** injection scenario for contrast.

### 3. STRIDE rating

- For each threat, fill a row: STRIDE category (focus on Tampering, Information Disclosure, Elevation of Privilege), impact (1-5), likelihood (1-5), and the resulting risk.

### 4. Map threats to controls

- For each threat, name the **structural control** that contains it: untrusted-content segregation, tool least-privilege, deterministic per-call policy, egress control, or human approval. "Add an instruction-defense prompt" is **not** an acceptable sole control — explain why.

### 5. Residual-risk statement

- Write a residual-risk paragraph: assuming injection *succeeds*, what is the worst outcome, and which control bounds it? If the answer to any threat is "unbounded," redesign until it is not.

## Starter guidance

Threat-model row template: