SoK: PIAtlas: Decomposing the Unbounded Prompt Injection Attack Space

Key points

• More than twenty public datasets describe prompt injection using incompatible vocabularies, often organized around delivery vector, attacker goal, or generation method.1
• In this Systematization of Knowledge, we present PIAtlas, a taxonomy organized instead around how the injected instruction is constructed to subvert the underlying model.1
• We derive the taxonomy from how LLMs are trained, prompted, and influenced by human-like framing, and compare it with historical attack data.1
• To ground this comparison, we release PICorpus, to our knowledge the largest license-clean collection of public prompt-injection datasets, and map thousands of its records to PIAtlas under a human-verified protocol.1

Sources (1)

• [1]SoK: PIAtlas: Decomposing the Unbounded Prompt Injection Attack Space
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 18, 04:07 AM

  Prompt injection is the dominant security risk for large-language-model (LLM) applications and agents, yet the field still lacks a coherent map of how these attacks are constructed.

  More than twenty public datasets describe prompt injection using incompatible vocabularies, often organized around delivery vector, attacker goal, or generation method.

Extractive summary: sentences quoted from the sources.