Skip to content

Prompt Injection

Untrusted content delivered to a language model through a data channel is interpreted as instructions rather than material to process, so an embedded directive executes at the model's privilege — the failure being the absence of any in-band boundary between instructions and data, not a lapse in alignment.

Core Idea

Prompt injection is the AI-security failure in which untrusted content delivered to a language model through a data channel — a retrieved document, tool response, or email body — is interpreted as instructions rather than material to process, so an embedded directive executes at the model's privilege. The defining structural fact is that the model's input is a single natural-language stream with no reliable in-band signal separating instructions (from the trusted operator) from data (content to be read), and the model has no intrinsic mechanism to enforce the boundary.

Scope of Application

Prompt injection lives across AI and software security, where a capability-bearing language model takes a single natural-language input stream with no reliable in-band control/data signal.

  • Direct injection — an end user steering the model against its own policy through their own input.
  • Indirect injection — the graver shape: an instruction planted in retrieved content the model ingests.
  • Tool-output injection — manipulating a tool's output the model reads and acts on.
  • Cross-tenant injection — one tenant's content interpreted as instructions in another's session.
  • Taint-analysis-style defense — the classical discipline imported: trace untrusted data to privileged sinks.

Clarity

Naming prompt injection relocates the defect from what the model knows or wants to how its input channel is structured, so hardening the weights is the wrong layer — a perfectly aligned model is still vulnerable. It cleanly separates the direct case from the graver indirect case, and lets a practitioner ask a precise design question about which channels carry attacker-influenced content and what privileged actions the model can reach.

Manages Complexity

The concept collapses an unbounded catalog of exploits to a single relation: can untrusted-provenance content reach a position the model reads, and can the steered model reach a privileged sink? The analyst tracks two coordinates per channel — provenance and privilege — and reads risk off a two-axis grid, with alignment, training, and payload wording dropping out. Defenses then sort as severing one axis or the other.

Abstract Reasoning

Prompt injection licenses a diagnostic move (relocate a misbehavior onto the channel, predicting an aligned model is still vulnerable), a threat-modeling reachability move (plot provenance against privilege), a severity-ordering move (indirect graver than direct because the victim is not at the keyboard), and an interventionist move reading each defense as severing the provenance leg (quarantine, markup) or the sink leg (least-privilege, sandboxing, out-of-band confirmation).

Knowledge Transfer

Within AI and software security prompt injection transfers as mechanism — the channel-relocation diagnostic, two-axis threat model, severity ordering, and leg-severing defenses carry intact across direct, indirect, tool-output, and cross-tenant injection, and are structurally identical to taint analysis. Beyond that cluster the pattern that travels is the parent control/data channel confusion (the confused-deputy/injection family, sibling to SQL injection and XSS). The LLM interpreter, natural-language channel, and application-layer remedies stay home; calling a forged-memo attack "prompt injection" is analogy.

Relationships to Other Abstractions

Local relationship map for Prompt InjectionParents appear above the current abstraction, mutual partners to the right, and children below. Node labels state whether each abstraction is prime or domain-specific; colors identify relation types.Prompt InjectionDOMAINDomain-specific abstraction: Injection Weakness — is a kind ofInjectionWeaknessDOMAINDomain-specific abstraction: Input Manipulation Attack — is a kind ofInput Manipulat…DOMAIN

Current abstraction Prompt Injection Domain-specific

Parents (2) — more general patterns this builds on

  • Prompt Injection is a kind of Injection Weakness Domain-specific

    Prompt injection is an injection weakness whose downstream interpreter is a language model and whose shared control/data substrate is natural language.

  • Prompt Injection is a kind of Input Manipulation Attack Domain-specific

    Prompt injection is input manipulation specialized to natural-language inputs that redirect a fixed deployed language-model system by making attacker content participate in instruction selection.

Hierarchy paths (3) — routes to 3 parentless roots

Neighborhood in Abstraction Space

Prompt Injection sits in a crowded region of the domain-specific corpus (18th percentile for distinctiveness): several abstractions share nearly its structure, so a description that fits it tends to fit its neighbors too.

Family — Unclustered & Miscellaneous (309 abstractions)

Nearest neighbors

Computed from structural-signature embeddings · 2026-07-12