Line of inquiry
Inquiring lines›How can we ensure AI systems remai…›How robust are defenses against at…›this line of inquiry
How do prompt injection attacks succeed or fail across defenses?
A broader line of inquiry — a family of 90 specific questions the research asks around this. Follow one into its inquiring-line page, or move sideways to a related line below.
Questions in this line of inquiry 90
Specific inquiring lines the field asks around this — ordered from the most general framing down to the most specific angle.
- How can simple prompt injection attacks extract reasoning trace content?
- Can repeated prompt injection compete with attention-based mitigation approaches?
- Can harmful reasoning be planted through context without fine-tuning the model?
- How do models prevent lower-level messages from spoofing higher-authority instruction sources?
- How does the copyable-rule squeeze interact with the false-alert cost squeeze?
- Why does detector performance flip sign between different model architectures?
- How does symbolic matching on tool names prevent prompt injection attacks?
- How do server-side filters hide their role in zero attack success?
- How can model routing and provenance become an attack surface?
- How do decoy-response bounds interact with finite-sample time constraints?
- How do adversarial triggers bypass the protections of longer reasoning chains?
- What makes reasoning-shaped payloads more effective than command-shaped attack prompts?
- Can minimal adversarial triggers disrupt reasoning across multiple unrelated queries?
- Can membership inference attacks reliably detect training data exposure?
- Can marginal-risk frameworks measure what defensive artifact releases add beyond existing threats?
- Can defenders detect attacks that probe scanner feedback as a learning signal?
- Can attack success rates hide server-side filtering or other non-adversarial defenses?
- Do the same attack success rates hold for other backbone models?
- Why do paraphrasing defenses fail against subliminal prompt attacks?
- Why do standard safety filters miss advertisement embedding attacks?
- Does publishing intrusion techniques help defenders more than attackers?
- Do synthetic attack traces in papers reflect real adversary behavior?
- How do chain-level defenses differ from per-skill scanner detection approaches?
- Does debate training avoid the detection evasion problem differently?
- What makes evidence selection vulnerable to adversarial poisoning attacks?
- Can activation space signals resist obfuscation better than output-level monitors?
- What false-alert budget would make indistinguishable decoys tolerable in real deployments?
- Does activation masking prevent the decoder from taking interpretability shortcuts?
- What properties must defenses preserve to survive substrate differences in persistence and inspectability?
- How does self-preference bias differ from exploitable prompt attack vulnerabilities?
- Can consistency training defend against adversarial text injection attacks?
- Why does text generalize better across models despite being more vulnerable?
- Why does attack generation scale faster than defense engineering?
- How much do trained model defenses improve against passive versus active attacks?
- Is model selection a stronger security lever than improving individual model defenses?
- Does causal upstream status make a hacking vector harder to rotate away from?
- Can re-scoring detect subliminal prompt injection without explicit semantic content?
- Why do small training data contaminations persist through alignment for most attack types?
- What detection rate is needed to make evidence-injection attacks impractical at scale?
- How do backdoored open-source checkpoints enable covert advertising at scale?
- Can knowledge poisoning attacks succeed with less than 0.05 percent modified text?
- Does continual training make persuaders more effective against proprietary models?
- What information asymmetry design makes the spy identification task work?
- Are capable language models more vulnerable to dark pattern manipulation than smaller ones?
- How do interchangeable encrypted blocks enable cross-model attacks?
- Can defenders tighten the total-variation bound in practice with measured benign activation rates?
- What unnamed exploits do models discover in training environments?
- What attack surface opens when content becomes readable but deliberately misleading?
- Does keyword priming explain why pre-training poisoning persists through alignment?
- Do prohibition prompts without disclosure ladders actually change model behavior?
- Do record-tampering and covert sabotage share a common underlying mechanism?
- Why are expensive rankers more resilient to adversarial content than cheap ones?
- Can defenses tuned against appended attacks stop prepended payloads?
- How do token-masking patterns distinguish genuine documents from poisoned ones?
- Did the attacker's framework use the same LLM model as defenders?
- Does the A-I-R framework distinguish insider attacks from adversarial positions?
- What makes a defense mechanism transfer directly rather than just function analogously?
- What defenses do text-to-text injection attacks still need?
- What makes semantic attacks harder to defend against than algorithmic ones?
- Can poisoned agent memories trigger real financial actions without detection?
- Can outcome-only safety reporting hide which layer actually contained an attack?
- How much does attack success depend on tuning to specific scanners versus general robustness?
- Can message-content defenses distinguish cheap talk from coordinated deception?
- How many probes does an attacker need to reach near-zero classification error?
- Why should defense evaluations test against adaptive rather than static attacks?
- How do fabricated rationales slip past safety guardrails that block explicit instructions?
- What feedback signal lets an attacker learn response distributions during classification?
- Does naming a specific hack in prompts prevent only that hack or broader classes?
- Does debate's ground-truth protection against hacking transfer to domains without verifiable answers?
- What makes dense retrievers vulnerable to partition-based poisoning exploitation?
- Why do Claude and OpenAI models cheat through different strategies?
- What framework measures marginal offense risk against existing attack technology?
- Can false positives from input filtering be reduced without sacrificing defense?
- Why does search effectiveness determine what method finds despite distance constraints?
- Why does scanning skill pairs not fully prevent cross-skill attacks?
- What makes false reporting discoverable across domains when the training never mentioned competition?
- How does phase-awareness prevent false positive exploit paths in static analysis?
- How does semantic framing differ from content injection attacks?
- What attacks work entirely within text without changing data flow?
- What makes a public-versus-hidden test score gap a useful hack indicator?
- Why do attack success rates alone fail to diagnose system failures?
- How do cyberattack and bioweapon risks scale with open model access?
- Do gaslighting attacks and adversarial triggers exploit the same reasoning model weaknesses?
- What economic incentives make advertisement embedding attacks persistently viable?
- How do covert attacks differ from a model's own undisclosed influence?
- What happens to scarcity-based defenses after solutions are published publicly?
- What defensive advantage does stigmergy offer over unmonitored channel analysis?
- How do trust relationships between defenders affect the effectiveness of defensive decoys?
- What feedback does ChainGuard return that an attacker could optimize against?
- Can Claude Code's proxy itself be compromised if the sandbox environment is fully breached?