You will be able to
- Explain why prompt injection exists: instructions and data reach the model as one token stream.
- Tell apart jailbreaking, direct prompt injection and indirect prompt injection through retrieved documents, web pages, emails and tool results.
- Name what an attacker can get: the system prompt, data in the context, unwanted tool actions and data leaving through links.
- Label every part of an assembled context by who controls it, and spot an instruction planted in untrusted text.
- Layer defences at the model, prompt and system level, and say which steps of an attack each one blocks or only makes less likely.
- Explain why no prompt-only defence is complete, and measure defences by violation rate and false refusal rate.
Topics
Your review
Sign in to keep your quick-check answers. The ones you miss come back for review after 1, 3 and 7 days, until they stick.
Sign in freeSources
AI Engineering · Chip Huyen, 2025
Chip Huyen. O'Reilly. Used: Ch. 5 "Prompt Engineering": "Introduction to Prompting" > "System Prompt and User Prompt"; "Defensive Prompt Engineering" ("Proprietary Prompts and Reverse Prompt Engineering", "Jailbreaking and Prompt Injection" including "Indirect prompt injection", "Information Extraction", "Defenses Against Prompt Attacks": "Model-level defense", "Prompt-level defense", "System-level defense").
Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection · Kai Greshake et al., 2023
Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, Mario Fritz. arXiv:2302.12173. Used: Abstract (fetched 2026-10-21). Open source
LLM01:2025 Prompt Injection (OWASP Top 10 for LLM Applications, project source) · OWASP Top 10 for LLM Applications project, 2025
OWASP Top 10 for LLM Applications project. OWASP. Used: Description, Types, Prevention and Mitigation Strategies, Example Attack Scenarios (fetched 2026-10-21). Open source