Summary: Wiki pages for raw/AI-attack-techniques/ — the 70-technique Arcanum Prompt Injection Taxonomy (PITAX v1.6.1), clustered by exploited mechanism.
Sources: raw/AI-attack-techniques/ (71 files: 70 technique cards + a source index)
Last updated: 2026-07-28
Pages
| Page | What it covers |
|---|---|
| pitax-taxonomy | The source itself: structure, licensing, why the aliases field matters, cluster map |
| delivery-direct-vs-indirect | The direct/indirect/both split and why it decides the threat model |
| persuasion-and-framing | 17 techniques — arguing, reframing, role-play, rule rewriting, fake citations |
| agentic-and-tool-attacks | 9 techniques — the four planes of a tool call, line jumping, rug pulls, confused deputy |
| obfuscation-and-encoding | 9 techniques — splitting, encoding, masking, glitch tokens |
| reasoning-model-attacks | 8 techniques — reasoning dilution vs overload vs overflow, thinking-budget steering, output-plane coercion |
| multi-turn-attacks | 7 techniques — crescendo, many-shot, echo chamber, decomposition |
| context-and-role-forgery | 8 techniques — forged tokens, turns, reasoning, tool results, identity |
| retrieval-and-memory-poisoning | 6 techniques — RAG ranking manipulation, memory injection, sleepers, worms |
| automated-attack-generation | 4 techniques — gradient search, fuzzing, best-of-N, autonomous strategy discovery |
| weight-level-attacks | Abliteration, gradient attacks, oracle extraction — and the deployment-model boundary |
The raw source’s own flat listing of all 70 with links is at raw/AI-attack-techniques/index.md. These pages do not duplicate it; they group by mechanism.
Reading order for someone new to the corpus
- pitax-taxonomy — what the source is
- delivery-direct-vs-indirect — the split that determines everything else
- persuasion-and-framing — the largest and least fixable cluster
- agentic-and-tool-attacks + retrieval-and-memory-poisoning — where the indirect attacks live
- automated-attack-generation — why individual technique defences are priced, not closed
Themes that recur across clusters
- Filters are usually in the wrong place, not too weak. T63 lives in the output-decoding plane; indirect techniques bypass user-input filters entirely; T42 lands at
tools/listbefore approval. - The model’s own output is the weapon. T29, T32, T35, T66, T68 all get the model to produce the harmful material from benign attacker input.
- Per-message evaluation is structurally defeated by multi-turn-attacks and per-action policy checking by T69.
- Structure is unauthenticated. context-and-role-forgery exists because roles, history, tool results and reasoning traces are text.
Cross-collection links
- AI Act Article 15 — the legal requirement to defend against several of these classes
- Code of Practice security mitigations — the control set
- CoSAI framework — playbooks for prompt injection, MINJA, RAG poisoning
- Root index
Gaps
- Examples live here, not in a separate folder. All 70 cards carry an
## Examplessection (306 payload lines) and## Ideas / Variations(354 lines).raw/Prompt-injection-examples/was deleted on 2026-07-28 as redundant against this. - What PITAX examples are not: full multi-turn transcripts, attributed real-world incidents, or payloads with a recorded outcome (target model, date, success). No source in the vault pairs a payload with evidence that it worked. ATLAS case studies partly cover the second — 18 real incidents — but as attack-chain steps, not verbatim payloads.
- PITAX catalogues attacks only, with no mitigations. That gap is now partly closed from outside: ATLAS mitigations supply technique-level defences for 76 of its 173 techniques — though 56% still have none. See ATLAS and PITAX for how the two map.
- ATLAS has no technique covering multi-turn-attacks or reasoning-model-attacks, so those two clusters remain PITAX-only.
Log
See log.