Prompt Injection: Why Attacks Work
SQL injection analogy → message list essence → lack of parameterization → overview of 5 attack types
THE QUESTION THIS PAGE ANSWERS
ANSWER FIRSTWhat is the key idea behind “Prompt Injection: Why Attacks Work”?
SQL injection analogy → message list essence → lack of parameterization → overview of 5 attack types
Inspect what the model is being shown. The practical move is to separate instructions, source material, history, tools, and output rules. Once the context is visible, the right fix is usually easier to choose.
Draw the input and output of one small workflow before changing its prompt or model.
Adding more text when the real issue is relevance, ordering, or a missing boundary.
User input is mixed into SQL commands
User input is mixed into system instructions
Root Cause: Lack of Parameterization
The ultimate solution to SQL injection is parameterized queries: data and instructions are completely separated.
But LLM message lists lack this mechanism: text from system, user, and assistant roles is all concatenated into one string and fed to the model. The model cannot distinguish between "this is an instruction" and "this is user data."
This is the fundamental reason Prompt Injection exists.
Here's what an actual Message List looks like ↓
5 Major Attack Types (detailed examples on the next slide)
Privilege Escalation Injection
Identity spoofing, authorization forgery, incremental privilege escalation
Role-Play Escape
DAN jailbreak, grandmother exploit, emotional manipulation
Few-Shot Malicious Injection
Bias planting, output format hijacking
Structural Symbol Injection
JSON hijacking, HTML concealment, delimiter spoofing
Metaphor and Disguise
Classical literature wrapping, coding tutorial disguise, reverse psychology
How “Attack Mechanics” becomes executable
“User input is mixed into SQL commands” is not about a magic phrase. It is about giving the model enough information to know who the work is for, what must be done, and what counts as acceptable.
Background sets direction; constraints set the boundary
“User input is mixed into system instructions” shows why a useful request separates the task, audience, source material, output format, and constraints. Without background, the model guesses. Without acceptance criteria, fluent text is not evidence that the task is complete.
More words do not guarantee a better result
Turn “Classical literature wrapping, coding tutorial disguise, reverse psychology” into a small experiment: change only one of background, requirements, or constraints while keeping the rest fixed, then observe which layer actually changes the output.
From “Attack Mechanics” to “Root Cause: Lack of Parameterization”
“Attack Mechanics” grounds the problem in “User input is mixed into SQL commands”. “Root Cause: Lack of Parameterization” then moves it toward “The ultimate solution to SQL injection is parameterized queries : data and instructions are completely separated. But LLM message lists lack this mechanism: text from system, user, and assistant roles is all co…”. Together, they show that the lesson is not just a conclusion to remember, but a claim with conditions.
Carry the judgment into the next situation
Build a request layer by layer: task and audience first, material and output rules next, constraints and acceptance checks last. Change one layer at a time so you know what actually helped.
- “Attack Mechanics”: User input is mixed into SQL commands
- “Root Cause: Lack of Parameterization”: The ultimate solution to SQL injection is parameterized queries : data and instructions are completely separated. But LLM message lists lack this mechanism: text from system, user, and assistant roles is all co…
- “The closing point”: Classical literature wrapping, coding tutorial disguise, reverse psychology
The final “The closing point” brings the discussion to “Classical literature wrapping, coding tutorial disguise, reverse psychology”. The useful thing to carry forward is knowing which judgments must be revisited when input, scale, or risk changes.
INTERACTIVE PRACTICE
Turn a vague request into a useful prompt
Clarify the goal, context, and constraints, then carry the finished prompt into the AI tool you use.
I turned one judgment from this article into a small experiment I could run today. Knowing what to observe next is more useful than simply remembering the conclusion.
After reading this, I first looked for the conditions behind the idea instead of copying the method into a project. That order made the later trade-offs much clearer.
When this judgment reaches real work, which constraint should be added first? I am curious which step matters most between reading and the first practical attempt.
No discussion on this article yet.