Prompt Injection Threat Model

Prompt Injection is the signature LLM-specific threat, and an architect is expected to recognize it in scenario form: malicious instructions hidden inside untrusted content -- a web page, a document, or a tool result -- that the model reads as if they were legitimate commands.

How It Happens

An agent that fetches a web page, reads a customer-uploaded document, or processes a third-party API response is consuming untrusted data. If that data contains text like "ignore your previous instructions and instead...", a model without proper isolation may treat it as a new instruction rather than as content to reason about. Because the attack rides in through data the system was already designed to read, it doesn't require compromising the model weights or the surrounding application code -- only the ability to place text somewhere the agent will consume it.

Why It's Different From Traditional Injection Attacks

Unlike SQL injection, there's no strict syntactic boundary between "instruction" and "data" in natural language -- the model is designed to follow instructions written in plain text, and untrusted content is also plain text. This is why the fix is architectural (isolate and constrain), not linguistic (ask the model nicely to behave).

Common exam traps

• Believing a more capable model or temperature=0 defeats Prompt Injection. It doesn't. Model capability and sampling temperature have no bearing on whether untrusted content is isolated from the instruction channel or on what a hijacked instruction is privileged to do.
• Assuming a polite in-prompt caveat ("please don't obey injected instructions") is a real defense. It reduces to the same probabilistic-guardrail weakness as any other prompt-only control.