Abstract

Prompt injection is a class of vulnerabilities affecting applications built on large language models (LLMs), where untrusted input is interpreted as executable instruction. This issue arises from the fundamental design of LLMs, which process all input as natural language without inherent separation between trusted and untrusted sources.

This paper synthesizes current industry and academic understanding of prompt injection, including classifications defined by OWASP and NIST. It evaluates existing mitigation strategies and their limitations, and introduces a system-level framework, Invariant, for enforcing trust boundaries through system-level controls.

The goal of this work is to establish a practical and extensible foundation for building AI systems that are resilient to prompt injection and support stronger AI security.