Attacks by taxonomy code

The payload arrives in the user turn of a chat.

The payload arrives in data from an external system, such as a fetched page, a retrieved document, or a tool's own description.

The payload arrives as text inside a picture that a vision model reads.

The behavior arrives in the weights or the pipeline before any prompt: fine-tuning data with a trigger, or a dependency the system trusts.

The attack text is found by a search against the model's own score, one token swap at a time, not written by hand.

A link or image URL in the answer carries data out when a client renders it.

A run of compliant turns commits the model to keep complying.

Benign turns first, the real ask last, with the model's own earlier answers as the momentum.

Fabricated prior exchanges in which the assistant already complied shift its behavior by in-context learning.

A forged prior assistant turn makes the model continue from a decision it never made.

The attack targets a model used as a judge or grader, planting text in the content under review so the judge returns the verdict the attacker wants.

The instruction hides in a tool's description or schema, so the agent is hijacked when it reads the tool list, before any call.

The payload stays benign until a trigger, here the next user turn.

Control tokens, or strings that resemble them such as a role label, forge a role boundary inside one turn.

The request is framed as an exception the standing rule does not cover, rather than as an override.

A fabricated answer or a task-complete marker makes the model treat the real task as done and move on to the injected one.

Forged reasoning that concludes the request is allowed hijacks the model's own reasoning channel.

A forged tool result or call syntax in the context makes the agent believe a tool already ran, and it acts on the forged output.

Padding fills the context window, so the system prompt or the real content is pushed out, truncated, or diluted below the model's attention.

The text claims an elevated identity or a permission already granted.

The instruction is stated plainly, with no trick. The baseline every other technique is judged against.

The attacker writes a passage that wins retrieval for the victim query, so the retriever itself delivers the payload into the prompt.

A harmless request precedes the dangerous one, and an agent that has just complied carries on without re-checking.

Data or instructions ride out in the arguments the model fills into a tool call, here a URL.

The instruction is base64-encoded, so a keyword filter cannot read it and the model must decode it first.

Letters are swapped for look-alike digits and symbols, as in leetspeak.

The instruction hides inside one emoji as variation selectors, so a reader and a keyword filter see a smiley and the model receives the bytes.

Letters are swapped for their full-width forms, which look like wider ASCII but sit in another Unicode block, so a byte-for-byte filter misses them.

Letters are swapped for look-alike characters from another Unicode block, so the text reads the same to a person but not to a byte-for-byte filter.

The instruction is written in code points that render as nothing: Unicode tag characters, or variation selectors riding on one emoji.

A right-to-left override reverses how the text is displayed, so the glyph order a person reads differs from the logical order the model reads.

The goal is a model or a store that carries the attacker's behavior before any prompt arrives.

The goal is a secret held in the system prompt.

The goal is to move data the model can see to a party that must not see it.

The goal is a tool call the user never asked for.

The goal is the victim's bill: every question goes to the model that costs the most.