Captions Are External Content Too: A Voice Prompt-Injection Defense Gate for Callbot Loops

The Same Flaw as Text Injection, Now in the Voice Channel

In a security blog published in July 2025, Microsoft frames indirect prompt injection as a structural risk of instruction-tuned LLMs: text from external content — webpages, emails, documents — can be read back as system instructions. To gauge the scale of that risk, Microsoft ran the LLMail-Inject challenge, drawing over 800 participants who submitted more than 370,000 prompts; the dataset is public. In a callbot loop, the sentence an ASR engine transcribes usually lands in the conversation history's "user turn" with no boundary marker at all. Without a device to separate what a caller said from what the operator actually trusts, the same vulnerability that holds for documents and email reappears inside a single phone call.

Why It's More Dangerous in a Callbot Loop: Real-Time, Irreversible Tool Calls

Text injection usually passes through a static document a human can skim first; a call streams in real time with no preview step. When a callbot carries write-capable tool calls — issuing refunds, pulling account data, transferring to an agent — a successful injection doesn't just produce a wrong answer, it becomes an authorized action. Call transfers and conference bridges can also mix in third-party audio mid-session, so the attack surface isn't limited to the original caller.

From Design to Operations: A Voice Prompt-Injection Defense Gate Checklist

The primary target metric is zero finalized utterances reaching the planning context without an untrusted-content marker. Secondary metrics: detection adds no more than 300ms to the next response's latency, and the false-block rate on legitimate requests stays under 2%. Check at every deployment that all three numbers move together.

The first failure pattern is running the classifier against the ASR engine's interim (unfinalized) hypotheses. An attacker who breaks a phrase into short fragments can slip past the pattern check at the interim stage, with the injection only completing once the final hypothesis merges — after the classifier that ran mid-turn has already passed it. The second is a classifier that only inspects the start and end of an utterance, missing an "ignore your previous instructions" phrase woven naturally into the middle of a long monologue — a pattern that shows up disproportionately often in third-party audio arriving through call transfers or conference bridges.

The recovery path runs the classifier only against finalized utterances, never interim ones, and rescans the full accumulated transcript right before each tool call rather than once per turn. The moment a pattern is flagged, that session's write-capable tool calls are immediately downgraded to read-only, and they stay downgraded until a human reviews the log and clears it.

Microsoft's spotlighting technique marks untrusted input with delimiters or datamarking so the model doesn't confuse instructions with external content. In a callbot loop, that means wrapping the ASR transcript in a position and format distinct from system instructions, tagging it explicitly as untrusted caller speech, and running a Prompt-Shields-style classifier on every turn for meta-instruction phrases such as "ignore previous instructions," "print your system prompt," or "enter admin mode." Every flagged segment logs the raw transcript, a timestamp, and the tool call that was about to fire as required fields; any write-capable tool call touching money or PII that's retried within a set window after a flag requires an extra layer of human approval, even if the classifier had already let it through.

Weekly, track both the false-positive rate (flagged segments that turned out benign) and the false-negative rate (confirmed-harm cases the classifier missed at the time). Keep the meta-instruction pattern list under version control as a running changelog, since attack phrasing keeps shifting, and every quarter replay previously flagged audio through the latest classifier to check whether detection has drifted.

Quick-Reference Checklist

Mark ASR transcripts as distinct from system instructions, run the classifier only on finalized utterances and rescan the full transcript before every tool call rather than per turn, and add a human-approval layer on any write-capable tool call retried after a flag — and the most common path from a single phone call to compromised system authority closes.

Reference

How Microsoft defends against indirect prompt injection attacks — Microsoft Security Response Center