prompt-injection-exploits-instruction-ambiguity
IN premise — entries/2026/06/21/wiki-Prompt_engineering-chunk-1.md
Created 2026-06-21T09:50:10+00:00
Prompt injection exploits the model's inability to distinguish developer-defined instructions from user inputs, analogous to SQL injection and XSS
Summary
Prompt injection works because the model reads developer commands and user text in the same stream and cannot reliably tell them apart, which means a user can sneak in overrides that redirect the model's behavior. This is the same structural failure that made databases vulnerable to SQL injection and websites to cross-site scripting: the system has no hard boundary between "trusted instructions" and "untrusted data," so the entire safety of the pipeline depends on a soft, statistical separation that attackers can cross.
Dependents
These beliefs depend on this one:
- IN disambiguation-requires-semantic-context-across-processing-paradigms — Both compiler lexers and LLM inference face the same fundamental disambiguation problem: the C lexer hack requires semantic feedback from the symbol table to distinguish typedef names from variable names, and prompt injection exploits the model's inability to distinguish developer instructions from user inputs — in both cases, a processing layer cannot disambiguate its inputs without higher-level semantic context that it structurally lacks.
- IN prompt-injection-is-architectural-vulnerability-not-bug — Prompt injection is an architectural vulnerability inherent to instruction-following LLMs — arising from the fundamental inability to distinguish developer-defined instructions from user-supplied inputs — rather than a fixable implementation bug, making it the primary and potentially irreducible security concern for deployed applications.