Perez & Ribeiro — 'Ignore Previous Prompt': foundational direct injection study
Date: 2022-11
Affected: GPT-3 (generalises to all instruction-following LLMs); directly contributed to OWASP LLM Top 10 LLM01
Attack vector: prompt-injection
Category: research-demonstrated
Severity: Critical

Fábio Perez and Ian Ribeiro published the foundational paper systematically documenting prompt injection attacks. They demonstrated that simple instructions such as 'Ignore previous instructions and [do X]' were consistently effective against GPT-3 across diverse task categories. They introduced the taxonomy of goal hijacking (redirecting the task) vs. prompt leaking (extracting the system prompt). This paper defined the attack surface that all subsequent prompt injection work builds on and directly influenced OWASP LLM01.

Impact: Established prompt injection as a systematic vulnerability class; influenced an entire generation of mitigations and attack research

Mitigations:
Design system so business logic leak is not catastrophic — defence in depth
Do not embed secrets, credentials, or internal URLs in system prompts
Input sanitisation for common injection patterns
Instruction hierarchy — system prompt has absolute priority regardless of user content
Run eval profiles: evals/garak/LLM01_prompt_injection.yaml
Run evals/garak/LLM07_system_prompt_leakage.yaml — threshold 0%
Structural separation of system instructions and user input (separate message types, not concatenation)
Treat system prompt confidentiality as a best-effort control, not a security boundary

Architectural layers (MAESTRO):
label: Foundation Models
notes: Foundational paper demonstrating that instruction following at L1 cannot distinguish trusted from adversarial instructions
role: origin
label: Deployment & Infrastructure
notes: Deployment architectures of the era provided no injection-resistant interfaces
role: blind-spot