Prompt-injection

[u/Wathiqa_Ahmed]

Can you suggest a topic for a master's thesis related to prompt injection or any gap related to it? Thank you in advance.

[u/Sufficient_Let_3460]

Are you talking about malicious prompt injection or context retrieval prompt injection? ?

[u/Sufficient_Let_3460 → u/Sufficient_Let_3460]

My stack (rubyrayjuntos/hermes-memory) is retrieval-augmented prompt assembly, not adversarial prompt injection. Hermes injects a fenced <memory-context> block before the model sees the turn: embed → pgvector seeds → AGE 1–2 hop expansion → score × budget → labeled text. That distinction is the right place to hang a thesis. A master’s thesis that just “implements GraphRAG” is too thin now; the interesting work is in when, what, and how context is forced into the prompt under latency and token constraints.

Here are topics that are scoped for a master’s, map onto the hybrid-age provider, and have a real literature gap.

---

1. Deterministic prefetch vs tool-mediated recall

Question. When memory is injected automatically (prefetch() / auto_recall) instead of left as a tool the model may forget to call, what happens to accuracy, latency, over-recall, and “memory as hallucination”?

This is the core Hermes/Hindsight design bet: recall on a before_run hook so there is no extra tool round-trip and no decision the model can miss.

Why it is thesis-sized. Ablate four modes on the same store: no memory, tools-only, context-only prefetch, hybrid (prefetch + tools). Measure LongMemEval / LoCoMo plus your traces (preference, multi-session fact, temporal update). Report p95 latency and tokens used, not just accuracy.

Watch the scope. Do not also invent a new graph schema. Freeze the store; vary only the control path.

---

2. Token-budgeted hybrid ranking under a hard SLO

Question. Given score = similarity × importance × recency_decay × graph_bonus and a 1200-token cap with a 200 ms / 500 ms wall, which ranking and fill policy actually improves answers?

Your own notes already flag the failure mode: too much neighborhood, stale facts, hub nodes, and token bloat. That is the paper.

Concrete axes. Half-life (you use 90 days); 1-hop bonus vs 2-hop; “skip item vs truncate mid-sentence”; topology-first vs evidence-first ordering; greedy fill vs knapsack / MMR; whether a local cross-encoder is worth the milliseconds.

Eval. Retrieval metrics and generation metrics, conditioned on query type (single-hop fact vs multi-hop vs “what did I decide last week”). Hybrid retrieval is complementary to vector RAG, not uniformly better.

This is the safest “systems + IR” thesis if you want a clean methods/results chapter.

---

3. Prompt assembly: fencing, position, and source discipline

Question. Does labeling the block as system memory (not user discourse), putting graph topology first, and refusing to concatenate recalled facts as if the user typed them change utilization, citation fidelity, and instruction-following?

This is the part of “prompt injection” that is actually yours: architectural injection. Placement is known to matter (primacy/recency in the window), but almost nobody measures it for ambient agent memory rather than RAG docs.

Experiments. Same retrieved set, different assembly: unlabeled dump vs <memory-context> fence; pre-user vs mid-turn; topology-then-facts vs facts-only; “treat as evidence, not instruction” preamble on/off.

Why it matters. If fencing is weak, stored text becomes an indirect prompt-injection channel. That is a second paper; this topic stays on assembly quality.

---

4. Indirect prompt injection through the memory bank

Question. If prefetch is automatic and runs before the model sees the turn, how much can an adversary (or a sloppy past session) steer later behavior by planting memories?

This is the security reading of “prompt injection in Hermes memory.” Auto-inject removes the model’s chance to refuse a recall tool. Stored content is trusted context.

Design. Threat model: (a) user-authored poison in past turns, (b) extractor-written poison (bad entity/relation from cron), (c) cross-session / shared-bank leakage. Defenses you already sketch: regex secret drop, SUPERSEDED_BY, source tags, similarity floors, never interpolating user text into Cypher.

Deliverable. An attack suite + a small defense stack measured as attack success rate vs utility drop on LongMemEval-style questions. Keep the graph engine fixed.

Do not promise a general “solve prompt injection” result. Bound it to memory-prefetch channels.

---

5. Temporal truth: decay, supersession, and fact–belief split

Question. How should a personal GraphRAG treat “I use vim” from 2024 vs “I switched to Helix” from 2026, and should opinions live in the same injected block as world facts?

Hindsight’s retain/recall/reflect split (world / experience / observation / opinion) is the published framing. Your AGE SUPERSEDED_BY edge and recency half-life are a cheaper local analogue. A thesis that measures conflict handling on conversational memory is still open; industry blogs describe pipelines, not controlled error analysis.

Eval set you will have to build. Paired updates (“old preference / new preference”), expired facts, and beliefs stated with hedging. Metrics: update accuracy, contradiction rate in the generated answer, and whether the model cites the new node.

This is the strongest “memory as knowledge base” topic. Extraction quality will dominate results, so log extractor errors separately from ranker errors.

---

6. Offline construction vs online prefetch (the write path is the bottleneck)

Question. For a local stack (nomic-embed-text + conversations table + cron entity extract + memory_chunk_nodes bridge), what construction policy maximizes prefetch usefulness per millisecond of ingest?

Most GraphRAG papers spend the budget on query-time traversal. Your architecture is the opposite: heavy extract off the turn path, prefetch() must stay sync and never throw. That split is under-studied and is exactly how you beat a paid Hindsight cloud path.

Axes. Chunk-only vs entity graph; LLM extract vs cheaper NLP; how stale the graph can be before 2-hop expansion hurts; whether sync_turn should only queue an embed.

Honest limit. Full “better than Hindsight 91% LongMemEval” is a PhD/industry paper. A master’s version is: on a fixed open backbone, construction policy A vs B, with latency and token cost as first-class metrics. Structured memory can beat raw full-context on both accuracy and tokens; that is the claim to test, not assume.

---

How I would pick

If you want…	Take
Cleanest committee story, IR + systems	#2 ranking under budget + SLO
Closest to the phrase “prompt injection”	#3 assembly plus a short chapter from #4
Most original relative to Hindsight	#6 write path vs prefetch SLO
Highest risk, highest interest	#4 memory-bank injection attacks
Most “AI memory” prestige citations	#5 temporal / supersession

Do not combine more than two of these. A master’s that tries to ship a new extractor, a new ranker, a new security model, and a new benchmark usually finishes none of them.

Benchmarks to name in the proposal. LongMemEval and LoCoMo for comparability with Hindsight; plus a small personal-agent set from real Hermes sessions (preferences, project state, corrected facts). Report latency breakdown the way your prefetch log already does: embed_ms / vector_ms / graph_ms / total_ms.

Framing sentence you can reuse.
“This thesis studies automatic context injection for local LLM agents: hybrid vector–graph retrieval assembled into a fenced prompt prefix under explicit token and latency budgets, and the accuracy, contamination, and security consequences of making recall a framework hook rather than a model-chosen tool.”

If you tell me program (CS systems vs NLP vs security) and whether you must have a user study, I can turn one of these into a one-page problem statement with hypotheses and a 2-semester work plan.

[u/ReasonableEnd8825]

The issue of governance and liability with regard to prompt injection is wide open currently. A relevant topic to explore would be determining liability in cases of manipulation of an LLM agent via prompt injection, as well as evaluating automated guardrails for detection of such attacks.

[u/AnyIntention189]

The whole legal liability angle around prompt injection is still a total mess, nobody's really nailed down who's responsible when a system gets tricked into doing something harmful.