Post
115
Prompt injection is not one thing. Here is a taxonomy for the indirect kind - an instruction planted in content the model reads, not typed by the user.
Two axes and the host it rides in.
- family - how the injection gets itself obeyed: bare, forged_frame, revocation, output_marking, and six more.
- action - what it asks for: disclose, exfiltrate, execute, unauthorized_action, and six more.
- carrier - email, web page, document.
Ten by ten is 100 pairs. Eight are structurally impossible, so the grid is 92 cells. Every cell x carrier triple holds 80 samples - equal fill within a carrier, 16,800 payloads in total. That is what makes a per-cell number mean the same thing for every detector.
- Every value is defined on the page, with a cited sample for each: mihailgribov/quadrat-ipi
- Dataset: mihailgribov/quadrat-ipi
Two axes and the host it rides in.
- family - how the injection gets itself obeyed: bare, forged_frame, revocation, output_marking, and six more.
- action - what it asks for: disclose, exfiltrate, execute, unauthorized_action, and six more.
- carrier - email, web page, document.
Ten by ten is 100 pairs. Eight are structurally impossible, so the grid is 92 cells. Every cell x carrier triple holds 80 samples - equal fill within a carrier, 16,800 payloads in total. That is what makes a per-cell number mean the same thing for every detector.
- Every value is defined on the page, with a cited sample for each: mihailgribov/quadrat-ipi
- Dataset: mihailgribov/quadrat-ipi