Banana Navy
Catalog FR
Lab · AI threat modeling · Detailed card

Indirect prompt injection (via transcription, content, inaudible sounds)

Driving the model from a secondary channel, unbeknownst to the user.

CardF16
CategoryAI2-TB7 (indirect prompt injection)
Layers9 · STT Transcription, 5 · Audio Normalization, 14 · LLM Interpretation
SystemAI voicebot

Filter secondary channels before they reach the model.

The threat

content injected through a secondary channel (transcription, fetched content, inaudible payloads in the media, history) drives the model unbeknownst to the user.

Blind spotWhy classic frameworks miss it

non-executable content (text, transcription, sounds) is not seen as a payload; the document-to-context-to-decision chain escapes classic input controls, and a vector inaudible to a human remains a real input for the model.

MitigationProposed approach

approved, controlled knowledge base and sources, no injectable persistent content, filtering of the audio or voice channel before transcription: the vector stays open as long as the transcription is not filtered.

The proposed control
no injectable persistent content; channel filtering before transcription.

Expected evidence
a secondary-channel injection never reaches the decision path.

SourcesReferences and public research

MITRE ATLAS 2026.07AML.T0051.001 Indirect
OWASP GenAIOWASP GenAI LLM01:2025 Prompt Injection
Public researchPublic research sources: MITRE ATLAS 2026.07 (verified technique mapping), OWASP GenAI, and the public risk-voicebot (aivansoul/risk-voicebot) template defining the 20 checkpoints. No client registry data: generic card, no rating, no verdict.

Explore the 20 security layers

MITRE ATLAS 2026.07 · OWASP GenAI · risk-voicebot