Implement computer vision solutions 3.3 Implement responsible AI for multimodal content
A claims app runs OCR on uploaded photos and screenshots and passes the extracted text to…
Study guide skill: Detect and mitigate indirect prompt injection by using embedded text in images
Question B7-007
A claims app runs OCR on uploaded photos and screenshots and passes the extracted text to a model through the Chat Completions API as third-party documents. A Prompt Shields document attack control is already in place. You want to add Spotlighting (preview) as an extra defense against instructions hidden in that text. Which two statements are correct? (Choose two.)
Select 2 answers.
Answer: D, E
Spotlighting (preview) is off by default and you enable it when you configure the document attack control. It marks documents as lower-trust by base64-encoding them, so the model might mention that the content is encoded; the guidance is to use the system prompt to tell the model not to mention encodings. Spotlighting has no direct cost, though the extra document tokens can raise usage costs, and it works only for models used through the Chat Completions API. Hidden instructions in third-party content are document attacks, so the text should stay in the document channel, not the user prompt.
Deep dive
How it works
Prompt Shields detect two kinds of attack:
- User prompt attacks: malicious prompts that try to bypass system instructions or safety training, scanned at the user input intervention point.
- Document attacks: hidden instructions in third-party content, such as documents, emails and web pages, that try to take control of the model session.
OCR text from uploaded photos and screenshots is third-party content, so the document attack control is the right shield, and the text should keep arriving as documents.
Spotlighting (preview) strengthens that defense. It tags input documents with special formatting that marks them as lower-trust content: the service transforms the document content with base64 encoding, and the model treats it as less trustworthy than direct user and system prompts. Microsoft suggests it as an additional defense for apps that process user-uploaded files or external web content, which is this app.
Facts to know for the exam:
- Off by default. You enable it when you configure document attack controls in the Foundry portal.
- Side effect. The model might mention that document content is base64 encoded, even when nobody asked. Use system prompts to tell the model not to mention encodings, or consider disabling Spotlighting if the mentions disrupt the user experience.
- Cost. Spotlighting has no direct cost, but base64 increases document tokens, which can raise model usage costs or push a long document past the input limit.
- Scope. It's available only for models used through the Chat Completions API.
The other options, and when you'd use them
- Works with the Responses API and agents: Spotlighting is available only through Chat Completions, so moving off it would lose the feature.
- Move the OCR text into the user prompt: Hidden instructions in third-party content are document attacks by definition. Moving them into the user prompt would also take them out of the documents that Spotlighting marks as lower-trust.
- Per-document charge: Spotlighting has no direct cost. Only the extra document tokens add usage cost.
Exam tip
Spotlighting = base64-marked documents, off by default, Chat Completions only, no direct cost. Fix encoding mentions with the system prompt.
References
Last reviewed: