> anchoring the LLM's answer in a web search and make it quote its sources. An output-filter that restricts results to a list of reachable URLs curbs some abus

> anchoring the LLM's answer in a web search and make it quote its sources. An output-filter that restricts results to a list of reachable URLs curbs some abuses, but you're still left with the problem of a malicious attacker ensuring certain kinds of results will always/never show up. Plus > If an LLM then, due to its training and various input and output filters, declines to e.g. compute a credit score for John Doe, because it can't verify whether its training set contained non-scoring-permissible data (which is regulated in many countries), I'd say it's working exactly as expected. I don't understand what you mean by this. The training-data is usually gone leaving only weights behind. Do you mean documents fed into the context instead? What algorithm would detect "scoring permissible" data versus everything else? Even then, indirect prompt injection means someone could twist the LLM-author's story so that CreditScoreBot immediately answers a given way, regardless of any prior rules expressed by the narrator.