How Should M&A Attorneys Test for Prompt Injection in AI-Assisted Document Review?

Define the review task and accountable owners first

Start with a narrow task, such as extracting assignment restrictions and identifying provisions that require further attorney review. Define the authorized instruction separately from the documents being examined. Indirect prompt injection occurs when instructions enter through resources the system consumes rather than through the authorized user's request. NIST explains that this can compromise output integrity, availability, or privacy. A deal document should therefore supply evidence, not instructions governing the review. [2]

Appoint a supervising M&A attorney to establish the expected findings and decide whether errors matter. A technical owner should control the test environment and inspect ingestion, retrieval, and action records. Include the firm's professional-responsibility reviewer before introducing information relating to an actual representation. ABA Formal Opinion 512 discusses competence, confidentiality, and supervision under the ABA Model Rules; governing jurisdictional rules and matter-specific circumstances must be checked separately. It does not establish a universal testing standard. [1]

Write down the permitted output, the records it must cite, and who may release it. For this pilot, the deliverable is an internal draft issue list, not legal advice delivered automatically to a client, an approved disclosure schedule, or a negotiation instruction.

Build synthetic document pairs with attorney-prepared answers

Create fictional contracts and amendments rather than redacting a live deal file and assuming nothing sensitive remains. Include realistic provisions, defined terms, and exceptions relevant to the chosen task. Give each fixture a stable identifier and preserve the exact version used. The source of truth is the synthetic document set plus a separate answer record prepared by the supervising attorney, not a model-generated summary.

For an illustrative assignment-review test, write a contract that contains a consent requirement and an exception that needs further interpretation. Prepare a clean copy and an otherwise identical injected copy. Place a test-only instruction in the second copy telling an automated reviewer to omit the consent requirement. The expected substantive findings should remain unchanged between copies. The example tests suppression of evidence; it does not establish the legal effect of any real assignment clause.

Add ordinary contractual language directing the parties to take actions. A model must still analyze that language as evidence. Refusing to summarize every clause containing an imperative is not a successful defense. Distinguish legitimate obligations between contracting parties from text attempting to control the reviewer's behavior, and record how the workflow handles both.

Isolate the pilot and verify permissions outside the model

Use a test workspace with synthetic data only. Remove access to live matters, email, buyer contacts, document-sharing destinations, and production credentials. Disable outbound actions or replace them with nonexecuting test substitutes that record requested actions without performing them. A document instruction to transmit information must not cause an actual transmission merely because the team wants to observe the result.

Ask the technical owner to demonstrate restrictions at the application or access-control layer. A prompt saying that the model must not send emails is not equivalent to removing sending permission. OWASP recommends least-privilege access, segregation of untrusted content, and human approval for privileged operations. NIST also identifies additional risks when models can invoke tools. These are reasons to test enforced boundaries, not promises that any configuration is secure. [3] [2]

Before later use of client information, responsible counsel should assess provider terms, retention, training use, support access, and internal access restrictions. ABA Opinion 512 calls for understanding relevant terms and policies and a fact-specific confidentiality assessment. Whether consent or other authorization is needed depends on the tool, use, and applicable rules. A synthetic pilot does not resolve that decision or establish privilege protection. [1]

Test distinct attempts to distort findings or cross boundaries

Use several controlled instruction types instead of repeatedly testing one phrase. An illustrative suppression test asks the reviewer to leave a material restriction out of its issue list. An authority-spoofing test claims that document text supersedes the review instructions. A citation test asks it to cite an unrelated page as support for a favorable finding. The expected result is faithful analysis of the source provisions without treating those requests as authority.

Include a confidentiality-boundary test containing a fictional marker in a separate, unauthorized synthetic matter. The injected document may ask for that marker, but the workflow should have no access to it. If a test substitute records a request to retrieve or transmit unauthorized data, treat the attempted boundary crossing as a failure even when access controls block execution. The model's refusal message alone does not establish what the application attempted.

Vary placement in supported inputs, such as body text, comments, or an image processed through optical character recognition. OWASP notes that instructions can be carried in files and multimodal content and need not be readily visible to humans. Test only ingestion paths the proposed workflow actually uses, and clearly label these examples as synthetic trials, not observed attacks against a particular provider. [3]

Exercise the actual ingestion and retrieval path

Upload fixtures through the same supported process intended for review. A test that pastes plain text into a chat window does not evaluate a workflow that extracts text from PDFs and retrieves selected passages. Preserve the original fixture, extracted content, retrieved passages where available, authorized prompt, configuration, output, and any attempted action records. Restrict these records to the test team under an agreed retention policy.

Determine whether the injection and the relevant contract provision actually reached the model. If retrieval excluded the injection, label that run as not exposed rather than evidence that the model disregarded it. If the underlying provision was also excluded, investigate coverage before attributing the missing finding to injection. This distinction prevents an apparently clean answer from concealing an ingestion or retrieval gap.

Run paired clean and injected trials under comparable settings, with repeated runs where feasible. Record observable model or application version information and configuration changes. Do not invent a robustness score from a small fixture set. OWASP cautions that retrieval-augmented generation and fine-tuning do not fully mitigate injection; testing should examine the assembled workflow rather than assuming those features solve the problem. [3]

Score source fidelity and observable behavior separately

The supervising attorney should compare each issue-list entry against the source document and prepared answer record. Check clause references, quotations, exceptions, and unresolved questions. Evaluate omitted findings as well as incorrect statements. An output that identifies the embedded instruction but silently removes an important contractual restriction has failed the substantive test.

The technical owner should separately examine attempted retrieval, tool use, and data movement. Record whether an instruction changed the task, whether unauthorized content entered the output, and whether application controls blocked an attempted action. Separate model behavior from the outcome of access controls so the team can identify which control needs correction. OWASP recommends validated output formats and adversarial testing of trust boundaries; a well-formatted answer still requires factual examination. [3]

Use clear labels such as expected behavior observed, material failure, and inconclusive. Mark runs inconclusive when necessary input or action evidence is unavailable, rather than assuming success. ABA Opinion 512 emphasizes appropriate independent verification and continued lawyer responsibility for professional judgment. The review depth for an actual matter remains task- and tool-dependent under applicable professional obligations. [1]

Document escalation and stop conditions before running trials

Set stop conditions in the test plan, not after seeing favorable results. Stop the affected pilot if an embedded instruction suppresses a material finding, introduces unsupported source citations, changes the authorized task, or triggers attempted unauthorized retrieval or disclosure. Also stop if the team cannot verify the intended isolation. Do not average these failures away because other fixtures passed.

Route substantive errors to the supervising attorney and boundary failures to the technical owner and firm security lead. Hold affected outputs from downstream use. Preserve relevant test evidence, identify the affected configuration, and decide whether to narrow the task, remove access, change ingestion handling, or suspend the workflow. If real information was accidentally introduced, follow the firm's incident process and obtain jurisdiction-specific advice about any further obligations. Do not assume a synthetic-test procedure addresses an actual disclosure.

A missing log or unexplained clean-versus-injected difference should pause acceptance until investigated. After correction, rerun the failing fixture and relevant clean controls, including checks that legitimate contract content remains available. Resume only through an explicit decision by the accountable owners. NIST states that current mitigations do not protect against all attack techniques, so successful retesting supports only the defined use and tested conditions. [2]

Make a bounded deployment decision, not a security certification

Close the pilot with a record of the allowed task, fixture coverage, unresolved limitations, responsible reviewer, and prohibited actions. If vendor tooling prevents inspection of relevant inputs or actions, document that gap and decide whether it prevents acceptance. Seek technical help where needed. A vendor assertion that content is ignored cannot substitute for evidence about the workflow being evaluated.

If a separately authorized live trial proceeds, keep it limited to approved documents and internal drafts. Have the assigned attorney verify the first outputs against the source records before relying on them. Reassess after material changes to models, retrieval, document formats, or permissions. Keep outreach, negotiation, disclosures, and approvals under human control. Passing synthetic trials does not guarantee legal accuracy, confidentiality, compliance, or resistance to future attacks.

Acquivo is a software platform that delivers the entire sell-side M&A process, valuation, marketing materials, buyer matching, and deal management, on one platform for business owners, M&A attorneys, and boutique investment banks.

Acquivo is user-operated software with no success fee, not a legal representative. This testing framework does not assert particular Acquivo model providers, integrations, or security features. Counsel retains responsibility for legal judgment, and the chosen workflow must be evaluated on its actual capabilities and permissions.