Learning Paths
Foundations
Start here if prompt injection is new to you. This path builds the core distinctions: direct vs indirect, model influence vs security impact, and model instruction ranking vs application authorization.
- Audience
- Newcomers, developers and security practitioners new to LLM applications
- Approximate time
- About 1.5 to 2 hours
- Prerequisites
- None
Learning objectives
- Define prompt injection as an instruction-control problem
- Tell direct and indirect prompt injection apart
- Explain why system prompts are neither secrets nor control boundaries
- Explain why input filtering alone cannot solve the problem
Path sequence
01 Core concepts
- 01 - LearnWhat Is Prompt Injection?
Establishes the core definition and separates instruction-control failure from security impact.
- 02 - LearnInstructions and Instruction Hierarchies
Shows why instruction ranking is model behavior, not application enforcement.
- 03 - LearnTrust Boundaries and Model Context
Explains how context is assembled and why controls sit outside the model.
- 04 - Lab - Controlled simulationDirect vs Indirect Prompt Injection (Lab)
Classify synthetic cases by where the instruction-like text entered the context.
02 Common misconceptions
- 05 - LearnSystem Prompts
Clarifies what a system prompt can do and why hidden is not the same as secret.
- 06 - LearnPrompt Injection vs Jailbreaking
Separates two overlapping terms whose usage varies across sources.
- 07 - Lab - Controlled simulationTrust Boundaries and Model Context (Lab)
Practice separating source, representation and trust in a controlled simulation.
- 08 - LearnWhy Prompt Injection Is Not Just Input Validation
Explains why filtering alone cannot separate instructions from data in natural language.
Go deeper (optional)
Knowledge check
Think through each question, then open it to compare with the expected reasoning. There is no score.
A model followed an instruction hidden in a web page, but no tool or data was affected. Is that a security incident?
It shows model influence, not security impact. Impact depends on what the application lets that output do. The event is still worth recording as evidence.
Why is keeping a system prompt hidden not a security control?
Its contents may be revealed, and the model does not enforce it deterministically. Anything security-relevant must be enforced by the application outside the model.
An instruction hierarchy ranks system above user text. Does that authorize or block actions?
No. It shapes model behavior probabilistically. Whether an action may run is decided by application authorization.
After this path, you should be able to...
- Classify a scenario as direct or indirect prompt injection
- Separate model influence from security impact
- Explain why a hidden prompt is not a secret
- Distinguish model instruction hierarchy from application authorization