The researchers propose the prompt injection attack taxonomy PIAtlas and release the PICorpus dataset

1. 20:31
   WeChat · LLM Security Research

   PIAtlas: dividing prompt injection into six mechanism categories, a taxonomy that deconstructs the prompt injection attack space by construction mechanism

   Researchers at the University of Southern California released a preprint paper on October 18, 2026 (arXiv:2610.24999), proposing the PIAtlas taxonomy, which deconstructs the prompt injection attack space by construction mechanism and divides attacks into six categories: instruction manipulation, structural disguise, obfuscation, social engineering, scenario framing, and output coercion. Each category corresponds to one model property that is exploited, and each is accompanied by signature rules that can be checked from text alone, so that labeling requires no guessing of attacker intent. The paper also releases PICorpus, which it calls the largest permissively licensed clean public injection dataset, mapping thousands of records to the six mechanism categories. The analysis finds that most attacks combine multiple mechanisms; widely used agent benchmarks cover only part of the attack space; and the mechanisms preferred by adaptive attackers are precisely the underestimated ones. This work has not yet undergone peer review, and manual labeling of the boundaries between the six categories also involves some subjectivity.

1. 12:07
   arXiv: Jailbreaks, Prompt Injection, Poisoning & Defenses

   SoK: PIAtlas Decomposes the Unbounded Prompt Injection Attack Space

   The researchers propose PIAtlas, a taxonomy of prompt injection attacks organized by how injected instructions are constructed to subvert the model, comprising six subversion mechanisms, from which a hierarchy of techniques and sub-techniques is built. The taxonomy is derived from LLM training, prompting methods, and the influence of human-like framing, and is compared against historical attack data. The authors also release PICorpus, which they describe as the largest publicly available collection of prompt injection datasets with clear licensing, mapping thousands of its records to PIAtlas under a manual verification process. The mapping shows that attacks typically combine multiple techniques from a small number of mechanisms, that commonly used agent benchmarks cover only part of the attack space, and that adaptive attackers favor mechanisms underestimated by curated benchmarks.

Current attention 35·Peak in the comparable period 35 (Nov 6 03:00)·Change over the comparable past 24 hours 0%