Prompt Injection Defense — References

The paper that established the problem, the standing catalogues, and the specification work on the text-level tricks a normalisation step has to handle.

The attack

• Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (Greshake et al., 2023), arXiv:2302.12173 — the systematic treatment of injection delivered through content the model retrieves rather than through the user's own message, including the delivery vectors and the observation that the attacker need never interact with the application directly.
• Zou, Wang, Carlini, Nasr, Kolter and Fredrikson, 2023, on universal and transferable adversarial attacks on aligned language models — relevant here for the demonstration that effective adversarial strings need not be readable, which is the argument against any defence that matches on the surface form of an instruction. Cited by name.

Catalogues and taxonomies

• OWASP Top 10 for Large Language Model Applications — the community catalogue in which prompt injection is the first entry; useful mainly for its enumeration of ingress paths and for vocabulary shared with security reviewers. Cited by name; the project has been renumbered and re-hosted between editions.
• NIST AI 100-2, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations — the formal taxonomy separating evasion, poisoning, privacy and abuse attacks, and the clearest available statement of which of these have no reliable mitigation. Cited by name; the report has been revised.

Text-level tricks

• Unicode Technical Report #36, Unicode Security Considerations — invisible characters, bidirectional overrides, and confusable glyphs, which is the specification behind the normalisation step that strips hidden instructions from retrieved content. Cited by name.

Why containment matters more than detection

• A Note on the Confinement Problem (Butler W. Lampson, Communications of the ACM, 1973) — the principle that a computation handling material it cannot trust must be limited in what it can reach, which is the foundation of capability reduction and of out-of-band analysis.

No verified reference is recorded for capability reduction keyed to trust class, for re-marking untrusted spans across turns, or for adversarial suites as release gates. Several recent systems proposing design-level defences were considered and omitted because their exact titles and author lists could not be confirmed.