[GH-ISSUE #201] websearch prompt injection management?

bsakaguchi commented

2026-10-15 18:04:41 +00:00

Owner

Originally created by @Technologicat on GitHub (Dec 14, 2023).
Original GitHub issue: https://github.com/SillyTavern/SillyTavern-Extras/issues/201

Hi,

Currently, websearch keeps injecting the most recent search results into the prompt until the user supplies a new query. Given the current capabilities of local LLM technology (i.e. highly promising but not quite ready for prime time), I'd like to be able to control this more explicitly.

I'd like an option to inject the results only with the initial message asking the question, or alternatively, a command to explicitly clear (forget) the web search injection until a new query is supplied.

The reason is that a mix of results from web search and vector storage sometimes confuses the LLM. But I still want to have both available, without constantly toggling the settings - a web search is better for an overview of recent news on a topic, whereas a vector store is better for answering questions about a given document.

Background/context:

As I mentioned in the other thread, I'm testing a SillyTavern-based LLM setup with retrieval, aiming to build an AI assistant for answering questions about particular scientific papers (among other things). "Retrieval" here is meant to include both vector storage (with PDF file input) and web search, as these cover complementary use cases.

For a concrete example, I fed in this paper into the vector store, and proceeded to ask the LLM (dolphin-2.2.1-mistral-7B running on an ooba backend) about the numerical method the authors of the paper had developed.

The model's initial output mentioned that the method belongs to the Runge-Kutta family. Then, I asked a follow-up question to get more detail. Here came the problem: websearch saw that I was asking a question, picked up the words "Runge-Kutta", and proceeded to inject random facts about unrelated Runge-Kutta methods. The LLM confidently composed its answer out of this mix of vector store extracts and web search results, mixing up what came from where, and incorrectly attributing everything to the paper being discussed. (The prompt template saying that these web results are relevant, probably added to the LLM's confusion.)

Disabling the web search plugin in the settings, and then regenerating the answer, worked fine. This time only the vector store extracts were injected into the prompt. The LLM answered correctly.

Arguably, in both runs, the LLM itself successfully extracted the key points of the text provided in the prompt - it was the contents of the prompt injection that were misleading. It actually surprises me how much a Mistral 7B can successfully dig up from text littered with broken math notation that was produced by automatically converting a PDF into plain text.

Of course, I'm not looking to get the actual equations from the LLM - the point is to summarize the key points (which can be described in plain English), so I'll know whether to look at the paper myself in more detail. Right now, in the testing phase, to be able to judge how well it works, I'm only feeding it papers I've already read. :)

Originally created by @Technologicat on GitHub (Dec 14, 2023). Original GitHub issue: https://github.com/SillyTavern/SillyTavern-Extras/issues/201 Hi, Currently, `websearch` keeps injecting the most recent search results into the prompt until the user supplies a new query. Given the current capabilities of local LLM technology (i.e. highly promising but not quite ready for prime time), I'd like to be able to control this more explicitly. I'd like an option to inject the results only with the initial message asking the question, or alternatively, a command to explicitly clear (forget) the web search injection until a new query is supplied. The reason is that a mix of results from web search and vector storage sometimes confuses the LLM. But I still want to have both available, without constantly toggling the settings - a web search is better for an overview of recent news on a topic, whereas a vector store is better for answering questions about a given document. **Background/context**: As I mentioned in the other thread, I'm testing a SillyTavern-based LLM setup with retrieval, aiming to build an AI assistant for answering questions about particular scientific papers (among other things). "Retrieval" here is meant to include both vector storage (with PDF file input) and web search, as these cover complementary use cases. For a concrete example, I fed in [this paper](http://www.its.caltech.edu/~jbae/publications/Capuano_2014.pdf) into the vector store, and proceeded to ask the LLM (dolphin-2.2.1-mistral-7B running on an ooba backend) about the numerical method the authors of the paper had developed. The model's initial output mentioned that the method belongs to the Runge-Kutta family. Then, I asked a follow-up question to get more detail. Here came the problem: `websearch` saw that I was asking a question, picked up the words "Runge-Kutta", and proceeded to inject random facts about unrelated Runge-Kutta methods. The LLM confidently composed its answer out of this mix of vector store extracts and web search results, mixing up what came from where, and incorrectly attributing everything to the paper being discussed. (The prompt template saying that these web results are *relevant*, probably added to the LLM's confusion.) Disabling the web search plugin in the settings, and then regenerating the answer, worked fine. This time only the vector store extracts were injected into the prompt. The LLM answered correctly. Arguably, in both runs, the LLM itself successfully extracted the key points of the text provided in the prompt - it was the contents of the prompt injection that were misleading. It actually surprises me how much a Mistral 7B can successfully dig up from text littered with broken math notation that was produced by automatically converting a PDF into plain text. Of course, I'm not looking to get the actual equations from the LLM - the point is to summarize the key points (which can be described in plain English), so I'll know whether to look at the paper myself in more detail. Right now, in the testing phase, to be able to judge how well it works, I'm only feeding it papers I've already read. :)

bsakaguchi closed this issue

2026-10-15 18:04:41 +00:00

bsakaguchi commented

2026-10-15 18:04:42 +00:00

Author

Owner

@Cohee1207 commented on GitHub (Dec 14, 2023):

You can escape questions using a period at the beginning of user messages so that they won't trigger a new search automatically, e.g. .What is beauty?

@Cohee1207 commented on GitHub (Dec 14, 2023): You can escape questions using a period at the beginning of user messages so that they won't trigger a new search automatically, e.g. `.What is beauty?`

bsakaguchi commented

2026-10-15 18:04:42 +00:00

Author

Owner

@Technologicat commented on GitHub (Dec 14, 2023):

Yes, but won't it still inject the latest previous search result into the prompt?

@Technologicat commented on GitHub (Dec 14, 2023): Yes, but won't it still inject the latest previous search result into the prompt?

bsakaguchi commented

2026-10-15 18:04:42 +00:00

Author

Owner

@Cohee1207 commented on GitHub (Dec 14, 2023):

Yes. I can propose a new syntax to discard the search, like !Now let's talk about... and everything above that won't trigger a search.

@Cohee1207 commented on GitHub (Dec 14, 2023): Yes. I can propose a new syntax to discard the search, like `!Now let's talk about...` and everything above that won't trigger a search.

bsakaguchi commented

2026-10-15 18:04:42 +00:00

Author

Owner

@Technologicat commented on GitHub (Dec 14, 2023):

Sounds great!

Being able to explicitly discard the search would solve the exact issue I had.

@Technologicat commented on GitHub (Dec 14, 2023): Sounds great! Being able to explicitly discard the search would solve the exact issue I had.

bsakaguchi commented

2026-10-15 18:04:42 +00:00

Author

Owner

@Technologicat commented on GitHub (Jan 19, 2024):

Judging by SillyTavern/public/scripts/extensions/third-party/Extension-WebSearch/index.js, it seems you have included this in the meantime... :)

I have one remaining issue here. Using the smart search script you posted in SillyTavern#1421, this doesn't provide a way to clear the context injected by that.

Would it be possible to add a slash command, too, that would do something like storage.clear()?

By the way, I think the smart search script is ingenious and should be included in the standard quick replies. It's the primary way I use the websearch module now. The only customizations I did were /genraw instruct=off ... (as you suggested in that thread) and /inject position=chat depth=1 .... In my tests the prompt looks more logical (to a human eye at least) with depth=1 than the suggested depth=2.

@Technologicat commented on GitHub (Jan 19, 2024): Judging by `SillyTavern/public/scripts/extensions/third-party/Extension-WebSearch/index.js`, it seems you have included this in the meantime... :) I have one remaining issue here. Using the smart search script you posted in [SillyTavern#1421](https://github.com/SillyTavern/SillyTavern/issues/1421), this doesn't provide a way to clear the context injected by that. Would it be possible to add a slash command, too, that would do something like `storage.clear()`? By the way, I think the smart search script is ingenious and should be included in the standard quick replies. It's the primary way I use the `websearch` module now. The only customizations I did were `/genraw instruct=off ...` (as you suggested in that thread) and `/inject position=chat depth=1 ...`. In my tests the prompt looks more logical (to a human eye at least) with `depth=1` than the suggested `depth=2`.

bsakaguchi commented

2026-10-15 18:04:42 +00:00

Author

Owner

@Cohee1207 commented on GitHub (Jan 19, 2024):

To unset the inject, use /inject id=webSearchResults (without any implicit value).

WebSearch now has the following syntaxes (as seen in the WebSearch extension readme):

.Ignore just this user message
!Ignore user messages above that point
Search `a piece of text` encased in backticks

Backtick and trigger phrases can be toggled separately, depending on what you'd want to use more.

@Cohee1207 commented on GitHub (Jan 19, 2024): To unset the inject, use `/inject id=webSearchResults` (without any implicit value). WebSearch now has the following syntaxes (as seen in the WebSearch extension readme): ``` .Ignore just this user message !Ignore user messages above that point Search `a piece of text` encased in backticks ``` Backtick and trigger phrases can be toggled separately, depending on what you'd want to use more.

bsakaguchi commented

2026-10-15 18:04:42 +00:00

Author

Owner

@Technologicat commented on GitHub (Jan 19, 2024):

Thank you. I honestly have no idea why it didn't occur to me to re-check the README when I noticed WebSearch had been updated. :)

Aaaah... so that's how it works. I didn't realize it was /inject, not /websearch, that was remembering the search context in the smart search script. I have skimmed the STScript manual, but probably too fast to internalize everything.

I ended up packaging the unset command into a "Clear search context" quick reply:

/inject id=webSearchResults | /echo Smart search context cleared.

Now this works perfectly for me. Closing the ticket.

@Technologicat commented on GitHub (Jan 19, 2024): Thank you. I honestly have no idea why it didn't occur to me to re-check the [README](https://github.com/SillyTavern/Extension-WebSearch) when I noticed WebSearch had been updated. :) Aaaah... so that's how it works. I didn't realize it was `/inject`, not `/websearch`, that was remembering the search context in the smart search script. I have skimmed the [STScript manual](https://docs.sillytavern.app/usage/st-script/), but probably too fast to internalize everything. I ended up packaging the unset command into a "Clear search context" quick reply: ``` /inject id=webSearchResults | /echo Smart search context cleared. ``` Now this works perfectly for me. Closing the ticket.

bsakaguchi commented

2026-10-15 18:04:43 +00:00

Author

Owner

@Technologicat commented on GitHub (Jan 19, 2024):

Ah, and I think backticks have superior usability over trigger phrases - no false positive when discussing things like "search for extraterrestrial intelligence" with your AI character. :P

For me, explicit smart search and an explicit context clear command are superior to even that.

@Technologicat commented on GitHub (Jan 19, 2024): Ah, and I think backticks have superior usability over trigger phrases - no false positive when discussing things like "search for extraterrestrial intelligence" with your AI character. :P For me, explicit smart search and an explicit context clear command are superior to even that.

bsakaguchi referenced this issue

2026-10-15 18:05:33 +00:00

[PR #125] [MERGED] Added argument --coqui-models #206

Rows
Columns

[GH-ISSUE #201] websearch prompt injection management? #125