Prompt Injection Glossary

Also: LLM agent

A non-standard umbrella term for a system in which a model helps select, sequence or parameterize actions involving tools, data or external systems. The surrounding application determines actual capabilities and enforcement.

The process of establishing who or what a principal is. Authentication does not answer whether that principal may perform a particular action now.

The decision whether an authenticated principal may perform a specific action on a specific resource, with particular parameters, destination and current context. It must be enforced outside model-generated prose.

A bounded implementation-level ability or grant, such as access to a tool, credential, scope, resource or operation. It belongs to the surrounding system, not to the model as a magical property.

Recorded evidence of where content came from, who or what supplied it, and how it was transformed. Provenance supports policy and investigation; it is evidence, not an automatic trust upgrade.

Prompt injection delivered through the application's intended user-input channel, such as a chat message. Direct describes origin and delivery path, not severity.

Also: outbound data flow

Outbound movement of data from a protected context to a destination or sink, such as a network endpoint, message recipient or external tool. Merely generating text internally is not egress.

A broad, non-standard umbrella term for mechanisms intended to constrain AI-system behavior or risk. Precise documentation should name the actual mechanism, such as a filter, classifier, policy gate, validator, authorization check or model behavior.

Also: Human-in-the-Loop, HITL

A human decision on a clearly presented, exact action and its consequences. Valid approval is informed, bound to the action and requested again after material changes; it is not standing authority.

Prompt injection delivered through content the system retrieves or processes, such as websites, email, documents, search results or tool output. Indirect describes the delivery path, not the impact.

Also: IFC

Policy enforcement that decides whether data with a given provenance or classification may move from a source to a particular sink through specified processing steps. It governs movement, not merely generated wording.

Analysis of user input or external content for risk signals before or during processing. Inspection produces evidence for handling decisions; it does not establish trust or authorize an action.

Text or structured input interpreted by a model as guidance about what to do. Instruction-like wording can appear in trusted application messages or untrusted data; wording alone does not create authority.

The application- or provider-defined right of a source to direct behavior within a particular scope. Untrusted prose cannot grant itself authority by claiming urgency, identity or a higher role.

Also: instruction precedence

A provider or application scheme for prioritizing competing instructions by role, source or privilege. It can improve model behavior, but it is not application authorization or a deterministic security boundary.

A broad, inconsistently used term for attempts to make a model produce behavior its provider or deployer intended to restrict. This site uses it mainly for challenges to model behavior, while prompt injection emphasizes control of an application's instruction path.

The principle of granting only the tools, data access, scope and lifetime needed for the current task. It limits impact before any model proposal is evaluated.

Also: context window

The information visible to a model for a particular inference step, including instructions, user input, retrieved content, tool results and prior messages. Visibility in context does not establish trust or authority.

A measurable change in a model's output, plan or tool proposal caused by an input. Influence is evidence of changed behavior, not automatically a security impact.

A model-generated suggestion for an action, tool, destination or parameters. It is input to application policy, not permission to execute.

Prompt injection delivered through images, audio, screenshots or mixed-modality content that becomes model-visible. Decoding a modality is not by itself proof of model influence or impact.

Checking model or agent output against sink-specific structure, type, format and allowed-value constraints before use. It is separate from encoding, authorization and information flow control, and does not make arbitrary executable text safe.

Prompt-injection influence that survives the initial encounter through stored memory, retained state or a source that is processed again. Persistence, later retrieval and security impact are separate facts.

A material divergence between the application's recorded task or approved plan and an agent's current proposed actions. Detection provides evidence for review; it does not authorize or block an action by itself.

An instruction-control failure in which attacker-controlled or otherwise untrusted input changes how a model follows the application's intended instructions. Model influence alone does not establish security impact.

Collection and correlation of content, context, model, plan, tool and enforcement signals that may indicate attempted or successful prompt injection. Detection is risk evidence, not authorization.

Also: information retrieval

The process of selecting content from an index, knowledge base or external source for a task. Selection indicates estimated relevance under a query, not source trust or instruction authority.

Also: RAG, retrieval augmented generation

An application architecture that retrieves external material and adds selected content to model context for generation. Retrieval relevance, rank or citation does not establish trust, truth, currency or action permission.

A consequence across a protected boundary, such as unauthorized disclosure, action, persistence or workflow manipulation. A changed model response becomes impact only when a downstream system or user action creates that consequence.

Also: access-filtered retrieval

Filtering retrieval candidates according to the requesting principal's access rights before content is returned. It limits unauthorized retrieval but does not establish truth, safety or instruction authority.

System-controlled marking, delimiting, transformation or channel separation that helps a model distinguish untrusted data from instructions. It is a probabilistic robustness layer, not a trust upgrade or authorization boundary.

Model-visible instructions placed in a privileged message or equivalent provider mechanism to shape behavior. A system prompt is neither inherently secret nor a deterministic security boundary.

Also: prompt extraction

An attempt to reveal or reconstruct hidden model context, especially application instructions. The security impact depends on whether that context contains information the application improperly treated as secret or authoritative.

Also: function calling

A pattern in which a model proposes a named operation and parameters for application execution. Tool availability does not imply permission; the application must validate and authorize every consequential call.

An ordered sequence of tool calls whose combined effects may exceed the risk of any single step. Each hop requires bounded authority, provenance and policy evaluation.

Also: tool result

Data returned by a tool or connector and made available to an application or model. A trusted tool does not make arbitrary free text in its result trusted or authoritative.

A boundary where data, identity, authority or assumptions change and therefore require explicit validation or policy enforcement. A message's position in model context is not itself a trust boundary.

Content that lacks authority for the security decision at hand. It can still be useful, accurate and benign; untrusted does not mean malicious or false.