Appendix B. Self-check answers and explanations

Chapter 1

1-1. Parameterized queries send query structure and values through separate channels, so the parser fixes the structure. LLMs receive system prompts, user requests, documents and tool results in one context; even with role markers, what counts as an instruction is determined by the model's probabilistic judgment rather than parser grammar, so structural separation does not hold.

1-2. Context assembly (whose text is mixed in?), tool execution (under whose authority, and after which checks, is it executed?), output interpretation (can output be interpreted as code or commands?) and memory writing (who reads stored content later?).

1-3. The remaining risk and its owner. Transfer does not reduce the risk itself, and acceptance means living with it. Without a record, no one owns the risk. Adding review triggers lets the decision reopen when circumstances change.

1-4. One example is routing all tool calls through a shared service account without logging the requesting user's identifier. In an incident, it becomes impossible to prove whose request caused an action and establish scope and responsibility. Token passthrough that leaves only the intermediary in downstream logs has the same flaw.

1-5. Assign ASI06 (Memory & Context Poisoning) to the starting point and ASI08 (Cascading Failures) to propagation. ASI08 describes a flaw spreading across agents, tools and workflows, rather than the initial flaw itself, so classify the direct compromise separately. Stopping only propagation without fixing the starting point allows the same incident to begin again.

1-6. MITRE ATLAS. Its adversary tactics and techniques are connected to case studies, making it suitable for stage-by-stage scenarios. NIST AI RMF answers how an organization manages AI risk (accountability, context, measurement and response); SAIF answers which security controls to establish and how (core elements and controls by risk).

1-7. The new boundary is where the model's summary becomes a channel-posting action and the post is rendered on other employees' screens. Review triggers include "adding an externally shared destination channel," "adding external document sources," "removing pre-posting confirmation" and "adding edit/delete functionality to the posting tool."

Chapter 2

2-1. Because invisible content such as white text, comments and metadata is still model input, review and screening must use the actual text the model receives (extraction results), rather than the rendered display presented to users.

2-2. Direct/indirect injection describes the entry path, while jailbreak describes the goal of bypassing model safety policies. For example, hidden instructions in a shared document that make a model generate prohibited content are both indirect injection and a jailbreak. A jailbreak filter watching only user input misses this case.

2-3. Break deviation by finalizing a plan from the user request before reading external content (fixed planning), or keeping raw content away from the planner and having a reader pass only fixed-format data. Intent verification that stops unexpected goal changes also qualifies. Break propagation by making write tools unavailable to external-content flows, requiring human confirmation for high-impact actions, or allowlisting recipients and domains.

2-4. It becomes harder to close quotes or tags, escape the data area and enter an instruction context. The model may still follow instructions inside the string value. Encoding clarifies boundaries without enforcing the model's judgment, so privilege separation and confirmation are also needed.

2-5. First, separately measure detection and false-positive rates with Korean attack, legitimate and boundary cases passing through the actual upload and extraction path. Second, define behavior for missing judgments and errors, and decide whether detections block, flag or trigger human review. Prompt Shields documentation likewise recommends evaluation per language because training and evaluation datasets are primarily in English.

2-6. Answer contamination distorts recommendations or omits conditions within normally formatted answers without sending sensitive information outside, so exfiltration rules do not detect it. Supporting documents and citations checked against originals, deterministic checks for required items, and human review of important decisions reduce it.

2-7. First, too many requests cause people to stop reading; restrict confirmation according to risk. Second, showing model summaries instead of actual arguments causes people to trust the explanation; show original targets, arguments and effects, bind approval to execution arguments, and ask again on changes. Monitor approval rates and time to approval to detect rubber-stamping.

2-8. An example answer follows (adding pre-publication human confirmation as a fourth line is also useful).

1. Probability-reducing layer: pass review text only as tool results labeled "external public page, author unverified," and use a screening model to flag instruction insertion.
2. Privilege separation: the review-reading stage cannot call posting tools; accept summaries only in a fixed table format and let deterministic code publish them.
3. Output restrictions: remove external links, images and markup before publication, and fix the destination to a specified wiki space.

Chapter 3

3-1. Examples include context assembly (excess fields; reduce with field-level tools), external model calls (originals leave the organization; redact/pseudonymize and check contracts), and logs/caches (originals remain; redact and set retention). Tool arguments (validation and destination restrictions) and derived summaries, embeddings or fine-tuning data (cleaning before training and deletion procedures) also qualify.

3-2. Logging and monitoring extensions and downstream activity, and rate limiting. These only detect harmful actions later or reduce their frequency; they do not reduce the functionality, permissions or autonomy that allow harmful actions, so they are not preventive measures.

3-3. Every request to a downstream system is authorized by that system against security policy, rather than the model's judgment. A design that puts "only administrators can approve refunds" solely in the system prompt while the refund API does not check caller permissions violates this principle.

3-4. Whether input/output is used for model training and how to opt out; abuse-monitoring-log retention; application-state retention and deletion (conversations, files, vector stores); approval conditions for reduced-retention options; and storage/processing regions. Terms vary by feature and contract, so record them with the date checked.

3-5. Render text by default using a method such as textContent. If formatting is essential, use a Markdown renderer with raw HTML disabled and an allowlist-based sanitizer (OWASP recommends DOMPurify). CSP is an additional defense layer, not a replacement for either.

3-6. Treating possession of a state handle as authentication is prohibited. Servers must validate every request, generate handles with secure randomness, bind them server-side to the user ID from a validated token and reject handles presented by other parties. Expiration reduces risk further.

3-7. Example: find_free_rooms(start, end, capacity) only reads available rooms and needs no confirmation. read_my_calendar(period) reads only the requesting employee's calendar using a user-context token, with no confirmation. book_room(room, start, end) only creates bookings, with no edit/delete functionality; it executes in user context, the server checks conflicts and permissions, and user confirmation precedes creation. Do not grant general-purpose calendar write access.

Chapter 4

4-1. Any two of handoffs, hosted tools (web search, file search, hosted MCP, Code Interpreter and so on) and built-in execution tools (computer, shell and so on). Alternative controls include blocking-mode input guardrails, isolated execution environments and domain allowlists, server-side downstream authorization, and wrapping calls in custom function tools for inspection.

4-2. Harmful-content classification asks "is this content harmful under safety policy?" Injection detection asks "does this input or document contain an attempt to change the model's instructions?" Authorization asks "may this party perform this action on this resource?" They cannot replace one another.

4-3. Target system and version; a test environment separate from production; synthetic data and fake secrets; allowed/prohibited actions (mock tools, no third-party systems); stop conditions; and contact/reporting arrangements (to whom, in what format and when).

4-4. They allow automatic leakage judgments when the value appears in output or external requests. They must not overlap real data or secrets, and must be unique enough that the model cannot generate them accidentally.

4-5. Attack success rate is 9 ÷ 240 = 3.75%; false-positive rate is 15 ÷ 500 = 3%. These do not reveal how many scenarios were ever breached, which layers caught attacks, whether legitimate tasks completed (task completion rate), or the paths and impact of successful attacks. Any one of these is sufficient.

4-6. The upper bound is approximately 3 ÷ 60 = 5%. The true success rate is likely below about 5%, but you cannot claim it is zero or that other paths, variants or model versions are safe.

4-7. To separate individual and combined effects, use four configurations: baseline, baseline + input screening, baseline + write-tool confirmation, and both. Hold evaluation-set version, model/prompt/tool versions and repetition counts (and judgment method) fixed. Track scenario-level attack success alongside legitimate-task completion (or false-positive rate). Comparing with a control removed can reveal overlap.

Chapter 5

5-1. Any four of session identifiers, access tokens, passwords, encryption keys and secrets, database connection strings, payment information and sensitive personal information. Alternatives include hashed user identifiers, trace IDs, tool names and result status, token counts and guardrail judgments.

5-2. Alerts only notify people while execution continues; budget caps stop execution in code. Per-task caps include model calls, tool calls and retries, subagent count, iteration depth, cost and runtime.

5-3. Continuous input overflow means repeatedly sending input exceeding the context window; cap input size. Resource-intensive queries exhaust resources through computationally expensive requests; use timeouts and throttling, resource allocation management and rate limits.

5-4. Anthropic says model-ID weights are fixed (older-generation aliases track the latest snapshot), but changes to serving infrastructure such as request routers, safety classifiers and sampling logic can slightly change observed behavior. Operations should rerun regression sets regularly, track deprecation/retirement schedules and test replacements before retirement.

5-5. Show the full, untruncated command including arguments; explain that executing code on the user's system is risky; and obtain explicit approval (with cancellation available). Run server commands in a sandbox with minimal default privileges and restricted file/network access.

5-6. Personal information of at least 1,000 data subjects is subject to loss, theft, leakage or related events; sensitive information or unique identifiers are affected; or the event results from unlawful external access to a personal-information processing system or equipment used to process personal information. Report to the Personal Information Protection Commission or Korea Internet & Security Agency within 72 hours of awareness. Exceptions exist for unavoidable reasons or where recovery/deletion substantially reduces the likelihood of harm to rights and interests, so the privacy officer and legal team make the actual decision.

5-7. Example: (1) Stop memory writes: the AI platform on-call operator disables new memory storage while retaining reads; a second stage disables reads too if poisoning is confirmed. (2) Block external sending tools: the service on-call operator stops email/message sending, leaving drafting only. (3) Disconnect connectors/MCP and revoke tokens: security operations stops reads and changes in the affected external system. (4) Read-only guidance mode: the service owner reduces support mainly to prepared guidance.