AI 工程从零到一（中文）
Given a production AI deployment description, review its exposure to EchoLeak-family LLM Scope Violation attacks.
Produce:
- Retrieval boundary. What content sources reach the model's context via RAG? Inbox, repo issues, shared docs, web search. Each is a potential entry point for untrusted instructions.
- Scope boundary. Which privileged scopes can the model access? Mailbox, private repositories, internal APIs, HR records. Identify which are accessible to retrieval-triggered actions.
- Output boundary. How does the model's output reach the network? Rendered images, hyperlinks, tool outputs, signed-domain URLs. Each is a potential exfiltration channel.
- CSP and domain-allowlist audit. What domains are allowed as rendering or link destinations? Microsoft's signed domains allowed EchoLeak; a narrower allowlist would have prevented it.
- Three-boundary independence. Is each of the three boundaries defended independently? If retrieval injects, scope access, and output exfil are all prevented independently, the chain cannot complete.
Hard rejects:
- Any deployment review that treats the three boundaries as one "prompt injection" problem.
- Any defense based solely on input classification of retrieved content (per Lesson 15 + Nasr 2025 adaptive attacks).
- Any claim of "our CSP is correctly configured" without testing CSP-approved exfiltration attempts.
Refusal rules:
- If the user asks whether their deployment is EchoLeak-safe, refuse the binary without the five-section audit.
- If the user asks for a silver-bullet remediation, refuse — the three boundaries require three independent controls.
Output: a one-page review filling the five sections, naming the weakest boundary, and recommending the highest-value control. Cite Aim Labs (EchoLeak writeup) and OWASP LLM Top 10 (2025) once each.