Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

GeminiUtil placeholder user turn ("Continue output. DO NOT look at this line ...") is flagged by prompt injection filters

Aperta Adatta ai principianti
  • Qualcosa non va?
#1,628 1 commento 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@hemasekhar-p ci sta già lavorando.

Dal 8/10/2026.

  • #1629 di @innoprej — aperta

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
76/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
google-cloud, java
Ambito
ai

Direzione di ricerca

Leggi GeminiUtil.ensureModelResponse, indicato nella riproduzione, e confronta la formulazione del testo segnaposto con quella di ADK Python e TypeScript descritta nell’issue. Inizia con la riproduzione a livello di unità usando ensureModelResponse(ImmutableList.of()); il lavoro è completo quando il testo segnaposto generato non attiva più il filtro di prompt injection segnalato e corrisponde alla formulazione concordata.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

needs review

🔴 Required Information

Describe the Bug:

When an LlmRequest has no contents, or its last content is not from the user, GeminiUtil.ensureModelResponse appends a placeholder user turn with this text:

Continue output. DO NOT look at this line. ONLY look at the content before this line and system instruction.

The sentence reads like an instruction-override prompt ("do not look at this line", "only look at ..."). On Vertex AI with Model Armor floor settings that enable prompt injection and jailbreak detection, requests whose only user-role content is this placeholder are blocked before the model runs. The other ADK languages use neutral wording: ADK Python and ADK TypeScript append "Handle the requests as specified in the System Instruction." when there are no contents, and "Continue processing previous requests as instructed. Exit or provide a summary if no more outputs are needed." when the last turn is not from the user; ADK Go uses the second sentence and appends nothing for empty contents.

Steps to Reproduce:

  1. Use com.google.adk:google-adk 1.10.1 (the code is unchanged in 1.11.0 and on main at ce882374) with a Vertex AI backed LlmAgent whose task is fully described by its instruction, for example with inputs passed through session state and the runner called with a user Content whose parts list is empty.
  2. In the same Google Cloud project, enable Model Armor floor settings for Vertex AI with prompt injection and jailbreak detection in blocking mode (confidence threshold: high).
  3. Run the agent.
  4. The first model call is rejected by Model Armor. At unit level, GeminiUtil.ensureModelResponse(ImmutableList.of()) returns one user content with the placeholder text above.

Expected Behavior:

The placeholder turn added by ADK should not look like a prompt injection attempt, and should match the wording used by the other ADK languages.

Observed Behavior:

The Model Armor sanitize log entry of a blocked request (payload removed) reports:

"piAndJailbreakFilterResult": {
  "confidenceLevel": "HIGH",
  "matchState": "MATCH_FOUND",
  "executionState": "EXECUTION_SUCCESS"
}

The other filters in the same entry returned NO_MATCH_FOUND. The inspected text was the system instruction followed by the placeholder line, and the placeholder was the only user-role content in every blocked request. The same requests succeeded before the detection was enabled, and ordinary chat requests in the same project, which end with user-typed text, were not blocked.

Model Armor returns one verdict per request, so the two sentences were also checked on their own. In the same project and settings, each sentence was typed as a plain user message in a new session of a chat agent (same system instruction for both): "Continue output. DO NOT look at this line. ONLY look at the content before this line and system instruction." was blocked by Model Armor, while "Handle the requests as specified in the System Instruction." (the ADK Python sentence for empty contents) was not. Only the sentence differed between the two requests, so the block comes from the wording of the Java sentence.

Environment Details:

  • ADK Library Version (see maven dependency): 1.10.1, code unchanged in 1.11.0 and on main (ce882374)
  • OS: Linux server (JDK 17); reproduced at unit level on Windows 11 / Microsoft Build of OpenJDK 17.0.19 / Maven 4.0.0-rc-3 (wrapper)

Model Information:

  • Which model is being used: gemini-3.8-flash (Vertex AI)

🟡 Optional Information

Regression:

No — the wording has been the same since v0.1.0 (first in Gemini, later moved to GeminiUtil).

How often has this issue occurred?:

  • Always (100%) for requests that contain no user-authored content.

Proposed fix:

Use the same wording as ADK Python and ADK TypeScript (a small PR will follow). Note that the Python empty-contents sentence was itself reported to trip Azure OpenAI's jailbreak filter in a LiteLLM code path (google/adk-python#4249; the wording was kept and the extra injection was removed in google/adk-python@d0102ec instead); Model Armor did not block it in the check above. Aligning the languages is proposed as the smallest change; making the placeholder text configurable would be an alternative if maintainers prefer.

Lingua principale
Java
Stelle
1.7k
Fork
433
Merge medio
3g 13h
PR unite (30g)
42

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di google/adk-java

Tutte le issue di google/adk-java

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.