Technical Summary: The Anatomy of a Prompt Injection

Problem Statement

Four years after the initial identification of prompt injection in 2022, the field lacks a standardized, component-based model for analyzing attacks. Currently, prompt injection artifacts are documented primarily as verbatim strings rather than structured exploits. This "string-matching" approach creates significant inconsistencies in analysis: two analysts may disagree on whether a "DAN" (Do Anything Now) prompt and a white-on-white text hidden in a resume constitute the same type of threat.

As Large Language Model (LLM) agents grow more capable, attacks increasingly target technical IT sinks (databases, web applications) and manipulate AI-assisted security analysis (e.g., malware triage). The current lack of a component model prevents defenders, red teamers, and Cyber Threat Intelligence (CTI) teams from effectively labeling, comparing, and mutating attacks. Furthermore, relying on the analogy of SQL injection is a poor guide for mitigation, as LLMs lack an inherent distinction between data and instructions, making residual risk difficult to eliminate via parameterized queries. The problem is not just the attack string, but the absence of a shared language to describe the artifact's functional roles.

Methodology

The paper proposes a seven-component model to formalize the structure of a prompt-injection artifact. This model decomposes the attack into five fields describing the artifact itself and two fields describing the environment. The methodology involves:

1. Defining Functional Roles: Identifying the specific jobs an attack must perform to succeed, moving beyond surface-level wording to the underlying mechanics (e.g., distinguishing between concealment and carrier).
2. Establishing Labeling Rules: Creating decision rules to reduce coder disagreement, ensuring that different natural-language realizations mapping to the same intent receive the same structural labels.
3. Cross-Referencing Prior Art: Mapping the new model against existing frameworks (Campaign taxonomies, Technique taxonomies, HOUYI, ReNeLLM, Promptware Kill Chain) to demonstrate how the new model spans the functional space previously covered only partially by others.
4. Worked Examples: Applying the model to real-world and illustrative cases, including the EchoLeak vulnerability (CVE-2025-32711) and an in-the-wild malware sample attempting to evade AI-assisted security analysis.

Key Contributions

1. The Seven-Component Model

The core contribution is a structured decomposition of prompt injection into seven components:

• Artifact Fields (The Prompt Body):

  • Carrier: Benign-looking content that transports the malicious instruction (e.g., a bug report, resume, or calendar invite). It must survive human review and machine retrieval.
  • Concealment: The obfuscation layer (e.g., white-on-white text, Base64 encoding, language switching) designed to evade human or filter detection.
  • Context-Break: The syntax escape (the "');--" of prompt injection) that terminates the trusted instruction context, forcing the model to parse subsequent text as a new instruction.
  • Privilege Escalation: Distinct from the context-break, this changes what the model is willing or able to do. It is split into Alignment Bypass (defeating refusal training via personas or emotional manipulation) and Capability Abuse (coercing an agent to use permissions it already holds, such as in the "confused deputy" pattern).
  • Payload: The executable instruction (shellcode). The paper defines functional classes (Recon, Exfiltration, Action, Persistence, DoS, Security Subversion) and emphasizes tracking Intent (tool target, sink, effect) rather than surface wording.

• Environment Fields:

  • Delivery Vector: How the artifact enters the trust boundary (Direct vs. Indirect). Indirect delivery (e.g., poisoned RAG documents) scales independently of attacker effort.
  • Return Channel: How results reach the attacker (Inline, HTTP, DNS, Email, Collaboration platforms, or Null for fire-and-forget attacks).

2. Logical Analysis Record

The paper introduces a JSON-like schema for recording incidents. This record separates Intent (the objective, e.g., show_current_customer_information), Surface (the specific phrasing or encoding), and Compiled Effect (the actual tool call or action). This allows analysts to cluster campaigns that share the same "technique shape" even with zero lexical overlap.

3. Crosswalks and Projections

The paper provides a crosswalk mapping the seven components to the Promptware Kill Chain and demonstrates how prior frameworks (HOUYI, ReNeLLM) are projections onto restricted subspaces of this model. For instance, ReNeLLM's two-component result is shown to be a valid but limited view of direct jailbreaks, while the full model is required for complex agentic attacks.

Results and Illustrative Cases

The paper validates the model through worked examples:

• EchoLeak (CVE-2025-32711): Demonstrated as a Capability Abuse attack where the carrier was a malicious email, the delivery was indirect via RAG, and the payload extracted secrets using permissions the agent already possessed. The return channel utilized a reference-style Markdown image to proxy data through Microsoft's own servers.
• AI-Evasion Malware Sample: An in-the-wild sample (project "Skynet") uploaded to VirusTotal attempted to manipulate an AI analyst. The binary acted as the carrier, with the payload intent being Security Subversion (specifically mark_benign). The return channel was Null, as the goal was to alter the triage decision without exfiltration.
• Agentic Composite: An illustrative example combining a poisoned Jira ticket (Carrier) with HTML comments (Concealment) and forged system tags (Context-Break) to trigger a SQL injection via a downstream tool.

Significance and Claims

The paper claims that this component model provides a shared language for offense, defense, and threat intelligence that is currently missing. Its significance lies in:

1. Standardization: It allows for the classification of attacks based on intent and structure rather than brittle string signatures. Two attacks with different wording but the same tuple of components (delivery, context-break, privilege escalation, intent, return channel) are identified as the same technique shape.
2. Improved Detection and Analysis: By focusing on the functional roles (e.g., distinguishing between alignment bypass and capability abuse), defenders can better understand the mechanics of an attack. The paper cites evidence that taxonomy-guided prompting improves jailbreak detection rates (from 65.9% to 78.0% in prior work), suggesting that structured labels enhance analysis.
3. CTI Utility: The model enables CTI teams to cluster campaigns and malware samples that share technique shapes, even when they embed prompt injection to manipulate AI-assisted analysis. It supports mapping to industry standards like STIX 2.1 and MITRE ATLAS.
4. Red Team Enablement: It allows red teamers to vary one component at a time while holding an intent chain fixed, facilitating systematic mutation and testing rather than opaque string iteration.

The paper maintains a modest stance, noting that the model is descriptive, not prescriptive for guardrail construction. It acknowledges that success remains model-dependent and non-deterministic, recommending the recording of expected Attack Success Rate (ASR) ranges rather than binary success indicators. The primary value proposition is the ability to decompose the prompt-injection artifact across the functional roles necessary for agentic and hybrid attacks, a capability no single prior framework possessed.