LLM安全实践：提示注入多隐藏于HTML源码而非正文
Almost every prompt injection I catch is hidden in the HTML, not in the text
做AI应用安全的同学必看，这篇给出了非常具体的HTML层提示注入检测逻辑与评分阈值，可直接参考用于构建更鲁棒的输入清洗管道。
Almost every prompt injection I catch in inbound email is hidden in the HTML. Not in the text you would read.
我拦截到的几乎所有入站电子邮件中的提示词注入都隐藏在 HTML 中，而非你会阅读的文本部分。
HTML comments, display:none, white on white, text-indent:-9999px, zero width characters dropped into the middle of a normal sentence. If you extract clean text and scan that, you miss all of it. So I scan the subject, the text and the raw HTML.
HTML 注释、display:none（隐藏显示）、白底白字、text-indent:-9999px（负缩进）、以及插入正常句子中间的零宽字符。如果你提取纯文本并扫描它，就会漏掉所有这些内容。因此，我会同时扫描主题行、正文和原始 HTML。
Hidden CSS on its own means nothing, loads of marketing email uses it for preheader text. "Forward all messages" on its own is thin too. Together they are the signal, so hidden CSS scores 12 by itself and 25 when a directive matched somewhere in the same message.
单独的隐藏 CSS 本身并无意义，大量营销邮件会用它来设置预标题文本。“转发所有邮件”这一指令本身也较为单薄。但当两者结合时便构成信号：隐藏 CSS 自身计 12 分，若在同一消息的某处匹配到指令，则计 25 分。
Over 60 out of 100 and I still don't drop the mail. It goes to the model with a note in the system prompt that it was flagged, and the reply comes back as a draft for a human instead of getting sent.
得分超过 60/100 时，我仍不会直接丢弃邮件。而是将其发送给模型，并在系统提示词中添加已标记的备注，回复将以草稿形式返回供人工处理，而不是自动发送。
How do you weight hidden text? Quarantine on sight, or only when it says something?
你如何对隐藏文本进行加权？是见疑即隔离，还是仅在其包含特定内容时才处理？
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力