PIAtlas: dividing prompt injection into six mechanism categories, a taxonomy that deconstructs the prompt injection attack space by construction mechanism

Researchers at the University of Southern California released a preprint paper on October 18, 2026 (arXiv:2610.24999), proposing the PIAtlas taxonomy, which deconstructs the prompt injection attack space by construction mechanism and divides attacks into six categories: instruction manipulation, structural disguise, obfuscation, social engineering, scenario framing, and output coercion. Each category corresponds to one model property that is exploited, and each is accompanied by signature rules that can be checked from text alone, so that labeling requires no guessing of attacker intent. The paper also releases PICorpus, which it calls the largest permissively licensed clean public injection dataset, mapping thousands of records to the six mechanism categories. The analysis finds that most attacks combine multiple mechanisms; widely used agent benchmarks cover only part of the attack space; and the mechanisms preferred by adaptive attackers are precisely the underestimated ones. This work has not yet undergone peer review, and manual labeling of the boundaries between the six categories also involves some subjectivity.