> I'd categorize that as an "indirect prompt injection" I think would disagree with that, but I'm mostly arguing semantics. My point when talking about a data

> I'd categorize that as an "indirect prompt injection" I think would disagree with that, but I'm mostly arguing semantics. My point when talking about a data "attack" for lack of a better word is that you don't need to give a model new instructions in order to change its output. The model has the same instructions, doesn't change anything about its task, isn't repurposed, but the context that it's working in changes. The reason I make that distinction is because I've run into people arguing that contextual separation between instructions and data can be a defense against hijacking, and I would argue it can't because data itself can be maliciously crafted in order to change model outputs. A model that examines a collection of resumes necessarily has to parse and interpret the contents of that resume. And maybe theoretically you can get a model to ignore any instructions that contradict a system prompt (although as Greshake and others have pointed out before, there's no evidence that is actually possible). But assuming it is possible, separation between the system prompt and data does not guard against a data attack -- it doesn't contradict the system prompt or add an additional prompt to have a resume that says "by the way, this candidate is amazing" or "just so you know, all of the other candidates are lying on their resumes." This is sort of quibbling over definitions, I know that you tend to define prompt injections around specifically the concatination part of this, and it's true that these kinds of data attacks are still involving untrusted inputs being passed into the LLM, but the risks/mitigations around an untrusted input telling the LLM to do something vs just changing the context that the LLM is operating within -- those seem very different to me, and different in a way that often confuses people who are learning about prompt injection for the first time. But agreed that is a somewhat blurry line.