Overview
This review organizes the fast-moving literature on defenses against prompt injection, including jailbreaking. It uses NIST's report on adversarial machine learning as its terminological foundation and proposes additional defense categories.
| Field | Value |
|---|---|
| Resource type | Systematic review |
| Original title | A Systematic Literature Review on LLM Defenses Against Prompt Injection and Jailbreaking: Expanding NIST Taxonomy |
| Authors | Pedro H. Barcha Correia, Ryan W. Achjian, Diego E. G. Caetano de Oliveira, Ygor Acacio Maria, Victor Takashi Hayashi, Marcos Lopes, Charles Christian Miers, Marcos A. Simplicio Jr |
| First public version | 2026-01-29 |
| Publication status | arXiv preprint (arXiv:2601.22240, January 2026). |
| Focus areas | Defenses, Evaluation |
| Artifacts | No code or data artifact listed |
| Last reviewed | 2026-09-26 |
Research question
Which prompt injection mitigation strategies have been proposed, how do they fit into and extend the NIST taxonomy, and what effectiveness have their authors reported?
Method and artifact
The authors conduct a systematic literature review covering 88 studies, including studies not documented in NIST's report or earlier reviews and surveys. They propose an extension of the NIST taxonomy and compile a catalog of reviewed defenses with their reported quantitative effectiveness for specific LLMs and attack datasets, noting which solutions are open source and model-agnostic. No separate code or data repository is listed here.
Key findings reported by the authors
Source statements: the points below summarize what the cited publication reports for the models and configurations it tested.
- The authors describe it as the first systematic literature review on prompt injection mitigation strategies.
- It identifies studies beyond those in NIST's report and earlier reviews.
- It proposes additional defense categories as an extension to the NIST taxonomy.
- It provides a catalog of defenses with reported effectiveness, open-source status and model-agnosticism, plus guidelines for researchers and developers.
Security interpretation
Site interpretation: this section is Prompt-Injection.net's explanation of why the work matters, not a claim made by the authors.
A shared vocabulary helps teams compare controls across vendors and papers. The catalog is useful for finding candidate defenses, but effectiveness figures describe each original study's setup. This site's defense pages therefore distinguish probabilistic model-facing and detection controls from deterministic authorization and information flow controls.
Limits and caveats
- Effectiveness values are collected from underlying studies with different models, datasets, attacks and metrics; they cannot be compared directly as a ranking.
- A review inherits the limits and possible biases of the studies it includes.
- The field moves quickly; defenses published after the review's search window are not covered.
- The review covers jailbreaking together with prompt injection; this site treats the two as related but distinct problems.
How to use this work
Use the review as a map of the defense literature and a source of citations to the original studies. Before adopting a defense, read the original study and test it against your own threat model and workloads.
Related content on Prompt-Injection.net
- Prompt Injection Defense - Defense in depth across provenance, authorization, tools, information flow, monitoring, containment, and response.
- Prompt Injection Detection - How to detect prompt injection attempts and effects at runtime by correlating content, context, model behavior, plan, tool and enforcement signals. Probabilistic evidence for response and investigation, never authorization or a replacement for deterministic enforcement.
- Input / Content Inspection - How to inspect user input and external content for prompt injection risk signals: inspection points, representations, risk-tiered dispositions, failure behavior and metrics. An inspection result is evidence, not a trust or authorization decision.
- Information Flow Control - How to decide, outside the model, whether data with a particular provenance and classification may move from a specific source through processing steps to a specific sink - across model, context, tool, storage and tenant boundaries.
- Output Validation - How to validate model and agent output against sink-specific structural and format constraints before use: strict parsing, allowlists, typed parameters, destination syntax. Separate from encoding, authorization and flow control; never makes executable free text safe.
- Prompt Injection vs Jailbreaking - How the terms overlap, why usage varies across sources, and how to classify and report a case by source, delivery, challenged boundary and effect.