gemma-trainer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—outsider-authored free text from user-supplied dataset files (e.g., JSON/JSONL “messages”, “prompt”, “chosen”, “rejected”) is loaded at runtime and converted into chat-formatted strings that are then tokenized and fed into the model/LLM training context (e.g., assets/sft_train.py uses load_dataset(...).train_test_split(...) and processor.apply_chat_template(...) on example["messages"]).