Prompt Injection
A problem in which instructions embedded in untrusted input disrupt the instruction or control boundaries that a model or system is intended to follow.
Example
Input contains instructions that conflict with the user's actual task, and the model prioritizes those instructions instead of the intended operation.
Distinctions and cautions
Prompt Injection is the broader problem of disrupting instruction and control boundaries through untrusted input. This differs from Prompt Sensitivity, which concerns changes in results following small, meaning-preserving variations in prompt wording, rather than adversarial redirection of control. If the result also involves assistance beyond applicable safety constraints, that outcome may be recorded separately as Unsafe Compliance.
Evidence
View evidence →
AI 100-2e2025 Adversarial Machine Learning
- Title
- AI 100-2e2025 Adversarial Machine Learning
- Author / organization
- Vassilev et al.; NIST
- Year
- 2025
- Source type / publication status
- Government official technical publication; published
- Supported concepts / claim context
- Prompt Injection, direct/indirect variants, jailbreak boundary.
- Scope and limitations
- Cybersecurity taxonomy, not the AI Reliability Catalog ontology.
- Access / version note
- Published official source.
- Recorded official URL / DOI / identifier
- DOI:
10.6028/NIST.AI.100-2e2025(DOI resolver)
Transferable Direct Prompt Injection via Activation-Guided MCMC Sampling
- Title
- Transferable Direct Prompt Injection via Activation-Guided MCMC Sampling
- Author / organization
- Li et al.
- Year
- 2025
- Source type / publication status
- EMNLP peer-reviewed research; published
- Supported concepts / claim context
- Direct Prompt Injection; adversarial attack construction.
- Scope and limitations
- Attack success rates depend on the tested models and scenarios.
- Access / version note
- Published EMNLP; exact DOI not recorded.
- Recorded official URL / DOI / identifier
- As recorded:
NOT_RECORDED_IN_RESEARCH_INPUT (ACL Anthology; exact DOI not surfaced)(no URL inferred)
PIGuard
- Title
- PIGuard
- Author / organization
- Li et al.
- Year
- 2025
- Source type / publication status
- ACL peer-reviewed research; published
- Supported concepts / claim context
- Prompt Injection guardrails and overdefense limits.
- Scope and limitations
- Performance of detectors/guardrails; not complete attack defense.
- Access / version note
- Published ACL.
- Recorded official URL / DOI / identifier
- DOI:
10.18653/v1/2025.acl-long.1468(DOI resolver)