# A CIA Triad-Based Taxonomy of Prompt Attacks on Large Language Models
## 3 Taxonomy of Prompt Attacks
### Prompt Attacks: Classification Overview  
To understand prompt attacks, it is important to understand the concept of prompting. Prompting involves crafting instructions in natural language to elicit specific behaviors or outputs from LLMs. This enables users, including non-experts, to interact with LLMs effectively; however, designing effective prompts requires skill and iterative refinement to guide the model towards achieving particular goals, especially for complex tasks [23].  
Prompts can be categorized into direct prompts, role-based prompts, and in-context prompts. Each type of prompt serves a different purpose, such as providing explicit instructions, setting a role for the model to assume, or embedding the context within the prompt to influence the model's response [24].  
Prompt attacks are a form of adversarial attack targeting language models and other AI systems by manipulating the input prompts to induce incorrect or harmful outputs. Unlike traditional adversarial attacks, which involve perturbing input data (e.g., image pixels or structured data), prompt attacks operate purely within the natural language domain, exploiting the inherent sensitivity of LLMs to minor changes in text prompts [25]. Prompt attacks can lead to significant security and reliability issues, particularly in safety-critical applications.  
To further elucidate the concept of a prompt attack, Figure 1 illustrates the lifecycle of a typical prompt injection attack on an LLM-integrated application. The process begins with a legitimate user sending an instruction prompt to the system. Simultaneously, an attacker injects a malicious prompt designed to override or manipulate the user's original intent, such as instructing the model to ignore prior instructions. The application forwards the combined legitimate and malicious prompts to the LLM, which processes both without distinguishing them. As a result, the model generates a misleading or harmful response influenced by the attacker's input. This compromised response is then delivered to the user, potentially leading to incorrect outcomes or misinformation.  
[PERSON] et al. [26] primarily evaluated the trustworthiness of GPT-3.5 and GPT-4 across multiple dimensions, including toxicity, bias, adversarial robustness, privacy, and fairness. In contrast, our study provides a structured cybersecurity perspective by categorizing prompt attacks using the Confidentiality, Integrity, and Availability (CIA) triad. Rather than broadly assessing trustworthiness, our work specifically addresses security vulnerabilities in LLMs by systematically classifying prompt-based threats and proposing targeted mitigation strategies. While [PERSON] et al. highlighted trust-related weaknesses in GPT models, our research extends these concerns by introducing a cybersecurity-driven framework that maps adversarial threats to established security principles. This structured approach bridges a critical gap in understanding and mitigating LLM security risks, ensuring a more comprehensive strategy for securing LLM-integrated applications.