# A CIA Triad-Based Taxonomy of Prompt Attacks on Large Language Models
## 2 Background and Motivation  
The Confidentiality, Integrity, and Availability (CIA) triad is a fundamental model in cybersecurity that provides a structured approach to assessing and mitigating security risks [10]. While traditionally applied to information security, recognition of its relevance to Artificial Intelligence (AI) and Machine Learning (ML) security has been increasing. Recent research has highlighted how AI models, including Large Language Models (LLMs), are vulnerable to adversarial attacks that compromise different aspects of the CIA triad. [PERSON] et al. [11] argued that ChatGPT (version 4.0, OpenAI, San Francisco, CA, USA) and similar LLMs pose significant cybersecurity threats by violating the CIA triad. Their study highlights privacy invasion, misinformation, and the potential for LLMs to aid in generating attack tools. However, their analysis lacks in-depth technical evaluation of real-world exploitation cases and mitigation strategies, making its conclusions more speculative than conclusive. This underscores the need for a structured approach to categorizing and addressing LLM vulnerabilities. [PERSON] and [PERSON] [12] proposed a collaborative filtering mechanism to enhance OAuth's security by refining access control and recommendations. While their approach addresses OAuth's limitations, it lacks empirical validation and may introduce bias by relying on historical user decisions, potentially compromising privacy instead of strengthening it. This reinforces the importance of using systematic security frameworks such as the CIA triad to evaluate AI-driven authentication and access control systems. By adopting the CIA triad as a foundational security model, our study systematically classifies prompt-based vulnerabilities in LLMs and aligns them with tailored mitigation strategies. Confidentiality threats include unauthorized extraction of proprietary model data and user inputs through adversarial prompts. Integrity risks stem from prompt injections that manipulate outputs to generate biased, misleading, or malicious content [13]. Availability threats involve Denial-of-Service (DoS) attacks, where adversarial inputs cause excessive computational loads or induce model failures. This structured approach ensures a comprehensive evaluation of security threats while reinforcing the applicability of established cybersecurity principles to modern AI systems. Since the advent of the transformer model, LLMs have experienced exponential growth in both scale and capability [14]. For example, Generative Pretrained Transformer (GPT) variants such as the GPT-1 model have demonstrated that models' Natural Language Processing (NLP) ability can be greatly enhanced by training on the BooksCorpus dataset [15]. Today, LLMs are pretrained on increasingly vast corpora, and have shown explosive growth over the original GPT-1 model. Advancements in GPT models have shown that these models' capabilities can extend further than NLP. For example, OpenAI's ChatGPT and GPT-4 can follow human instructions to perform new complex tasks involving multi-step reasoning, as seen in Microsoft's Co-Pilot systems. Today, LLMs are becoming building blocks for the development of general-purpose AI agents and even Artificial General Intelligence (AGI) [16]. While LLMs can generate high-quality human-like responses, vulnerabilities exist within the response generation process. To mitigate these risks, providers implement content filtering mechanisms and measures during the model training stage, such as adversarial training and Reinforcement Learning from Human Feedback (RLHF) [17]. These processes help to fine-tune the behavior of the model by addressing edge cases and adversarial prompts in order to improve the overall safety and reliability of the generated outputs. However, despite these measures, adversaries can still exploit the system through a prompt engineering technique known as a prompt attack.