Prompt Injection Research Library

Resource types

Paper

A research publication presenting a threat model, method or defense.

Benchmark

A reusable evaluation suite with test cases and metrics for comparing systems.

Dataset

A published collection of examples, released for further research.

Systematic review

A structured synthesis of many underlying studies, not a new head-to-head experiment.

Research entries

Most recent first public version first. Filter by resource type or focus area.

Showing 8 of 8 entries

1. Systematic review

   Systematic Review of Prompt Injection Defenses (2026)

   A 2026 systematic literature review of 88 studies on prompt injection and jailbreak mitigations that extends the NIST adversarial machine learning taxonomy and catalogs reported defense effectiveness.

   Authors

   Pedro H. Barcha Correia et al.

   First public version

   2026-01-29

   Publication status

   arXiv preprint (arXiv:2601.22240, January 2026).

   Focus areas

   Defenses, Evaluation

   Artifact

   None listed

   Key caveat

   Reported effectiveness comes from heterogeneous underlying studies, models and datasets; it is not one uniform head-to-head benchmark.

2. Paper

   CaMeL - Defeating Prompt Injections by Design

   A system-layer defense that derives control and data flow from the trusted user query, so untrusted data cannot change program flow, and enforces capability-based policies on tool calls.

   Authors

   Edoardo Debenedetti et al.

   First public version

   2025-03-24

   Publication status

   arXiv preprint (arXiv:2503.18813; v2 dated 2025-06-24).

   Focus areas

   System design, Defenses, AI agents

   Artifact

   Code or data available

   Key caveat

   "Provable security" holds under the paper's threat model and policies on AgentDojo; it is not a guarantee for every agent or implementation.

3. Benchmark

   AgentDojo - Dynamic Environment for Agent Prompt Injection Evaluation

   An extensible evaluation environment with 97 realistic agent tasks and 629 security test cases that measures both task utility and security of tool-using agents under prompt injection.

   Authors

   Edoardo Debenedetti et al.

   First public version

   2024-06-19

   Publication status

   Published in the NeurIPS 2024 Datasets and Benchmarks Track; also on arXiv (arXiv:2406.13352).

   Focus areas

   AI agents, Indirect injection, Evaluation, Defenses

   Artifact

   Code or data available

   Key caveat

   Scores depend on the model, defense and attack versions evaluated; the arXiv record notes a later update fixing a bug and updating a task suite.

4. Paper

   The Instruction Hierarchy - Training Models to Prioritize Privileged Instructions

   An OpenAI paper proposing that models should rank instructions by privilege and a data generation method that trains a model to ignore conflicting lower-privilege instructions; experiments apply it to GPT-3.5.

   Authors

   Eric Wallace et al.

   First public version

   2024-04-19

   Publication status

   OpenAI research publication, also available on arXiv (arXiv:2404.13208).

   Focus areas

   Model training, Defenses, Direct injection, Indirect injection

   Artifact

   None listed

   Key caveat

   A trained, probabilistic behavior evaluated on GPT-3.5; it is not a deterministic security boundary and does not solve prompt injection in every application.

5. Benchmark

   InjecAgent - Indirect Prompt Injection Benchmark for Tool-Using Agents

   A benchmark of 1,054 test cases across 17 user tools and 62 attacker tools that measures whether tool-integrated LLM agents can be steered by instructions in external content.

   Authors

   Qiusi Zhan et al.

   First public version

   2024-03-05

   Publication status

   Published in Findings of the Association for Computational Linguistics: ACL 2024 (ACL Anthology); also on arXiv.

   Focus areas

   Indirect injection, AI agents, Evaluation

   Artifact

   Code or data available

   Key caveat

   Attack success rates are for the 30 agents evaluated at the time and a fixed test set; they do not describe current agents.

6. Benchmark

   BIPIA - Benchmark for Indirect Prompt Injection Attacks

   A benchmark that measures how LLMs react to instructions embedded in external content across several task types, together with proposed black-box and white-box defenses.

   Authors

   Jingwei Yi et al.

   First public version

   2023-12-21

   Publication status

   Available on arXiv (arXiv:2312.14197); the arXiv entry states it was accepted by KDD 2025.

   Focus areas

   Indirect injection, Evaluation, Defenses

   Artifact

   Code or data available

   Key caveat

   Model results are historical for the configurations tested; the official repository is archived and read-only.

7. Dataset

   Tensor Trust - Human-Generated Prompt Injection Dataset

   A large dataset of human-written prompt injection attacks and prompt-based defenses collected through an online game, also used to build benchmarks for prompt extraction and prompt hijacking.

   Authors

   Sam Toyer et al.

   First public version

   2023-11-02

   Publication status

   ICLR 2024 (International Conference on Learning Representations); also on arXiv (arXiv:2311.01011) with an official project page.

   Focus areas

   Direct injection, Datasets, Evaluation

   Artifact

   Code or data available

   Key caveat

   Game attacks target a constrained setting; the paper reports only that some strategies transfer to deployed applications, not that all do.

8. Paper

   Not What You've Signed Up For - Indirect Prompt Injection (Greshake et al.)

   The foundational paper arguing that LLM-integrated applications blur data and instructions, so attacker-controlled retrieved content can influence an application without anyone prompting the model directly.

   Authors

   Kai Greshake et al.

   First public version

   2023-02-23

   Publication status

   16th ACM Workshop on Artificial Intelligence and Security (AISec '23); also on arXiv (arXiv:2302.12173).

   Focus areas

   Indirect injection, System design

   Artifact

   None listed

   Key caveat

   Demonstrations target systems and model versions available in early 2023; they show feasibility, not current prevalence.