Topic 1

Instructions and data share one stream

Prompt injectionPrompt injectionText that gets a model to follow instructions its developer never intended, possible because instructions and data reach the model as one token stream.Where this is taught exists because a model has no separate channel for instructions. Your system promptSystem promptThe developer's instructions, sent as the first message with the system role. The model gets it in the same sequence as the user's text; it carries more weight only through position and training.Where this is taught, the user's message, a retrieved document and a tool's result are all concatenated into one prompt and turned into tokensTokenA piece of text from a model's fixed vocabulary: a word, part of a word, a character or a byte sequence. Models read and write tokens, not characters.Where this is taught (Models don't read text). A sentence that reads like an instruction looks the same wherever it came from.

Prompt injectionPrompt injectionText that gets a model to follow instructions its developer never intended, possible because instructions and data reach the model as one token stream.Where this is taught is text that gets the model to follow instructions the developer never meant it to follow. Greshake et al. put the cause in one line: LLM-integrated applications "blur the line between data and instructions" (arXiv:2302.12173, abstract, fetched 2026-10-21).

You saw a token-level version in Module 01: special-token injection, where user text forges a control tokenTokenA piece of text from a model's fixed vocabulary: a word, part of a word, a character or a byte sequence. Models read and write tokens, not characters.Where this is taught. That one has a clean fix, encoding untrusted text as ordinary text. Plain-language instructions have no such fix: there is no "ordinary text" mode for meaning.

The book's diagnosis (Ch. 5, "JailbreakingJailbreakingGetting a model past its safety features. OWASP treats it as a form of prompt injection.Where this is taught and Prompt Injection"): prompt attacks work "precisely because models are trained to follow instructions." A model that follows instructions better can follow an attacker's better too.