⭐ Star on GitHub

Summary: Wiki pages for raw/AI-attack-techniques/ — the 70-technique Arcanum Prompt Injection Taxonomy (PITAX v1.6.1), clustered by exploited mechanism.

Sources: raw/AI-attack-techniques/ (71 files: 70 technique cards + a source index)

Last updated: 2026-07-28


Pages

PageWhat it covers
pitax-taxonomyThe source itself: structure, licensing, why the aliases field matters, cluster map
delivery-direct-vs-indirectThe direct/indirect/both split and why it decides the threat model
persuasion-and-framing17 techniques — arguing, reframing, role-play, rule rewriting, fake citations
agentic-and-tool-attacks9 techniques — the four planes of a tool call, line jumping, rug pulls, confused deputy
obfuscation-and-encoding9 techniques — splitting, encoding, masking, glitch tokens
reasoning-model-attacks8 techniques — reasoning dilution vs overload vs overflow, thinking-budget steering, output-plane coercion
multi-turn-attacks7 techniques — crescendo, many-shot, echo chamber, decomposition
context-and-role-forgery8 techniques — forged tokens, turns, reasoning, tool results, identity
retrieval-and-memory-poisoning6 techniques — RAG ranking manipulation, memory injection, sleepers, worms
automated-attack-generation4 techniques — gradient search, fuzzing, best-of-N, autonomous strategy discovery
weight-level-attacksAbliteration, gradient attacks, oracle extraction — and the deployment-model boundary

The raw source’s own flat listing of all 70 with links is at raw/AI-attack-techniques/index.md. These pages do not duplicate it; they group by mechanism.

Reading order for someone new to the corpus

  1. pitax-taxonomy — what the source is
  2. delivery-direct-vs-indirect — the split that determines everything else
  3. persuasion-and-framing — the largest and least fixable cluster
  4. agentic-and-tool-attacks + retrieval-and-memory-poisoning — where the indirect attacks live
  5. automated-attack-generation — why individual technique defences are priced, not closed

Themes that recur across clusters

  • Filters are usually in the wrong place, not too weak. T63 lives in the output-decoding plane; indirect techniques bypass user-input filters entirely; T42 lands at tools/list before approval.
  • The model’s own output is the weapon. T29, T32, T35, T66, T68 all get the model to produce the harmful material from benign attacker input.
  • Per-message evaluation is structurally defeated by multi-turn-attacks and per-action policy checking by T69.
  • Structure is unauthenticated. context-and-role-forgery exists because roles, history, tool results and reasoning traces are text.

Gaps

  • Examples live here, not in a separate folder. All 70 cards carry an ## Examples section (306 payload lines) and ## Ideas / Variations (354 lines). raw/Prompt-injection-examples/ was deleted on 2026-07-28 as redundant against this.
  • What PITAX examples are not: full multi-turn transcripts, attributed real-world incidents, or payloads with a recorded outcome (target model, date, success). No source in the vault pairs a payload with evidence that it worked. ATLAS case studies partly cover the second — 18 real incidents — but as attack-chain steps, not verbatim payloads.
  • PITAX catalogues attacks only, with no mitigations. That gap is now partly closed from outside: ATLAS mitigations supply technique-level defences for 76 of its 173 techniques — though 56% still have none. See ATLAS and PITAX for how the two map.
  • ATLAS has no technique covering multi-turn-attacks or reasoning-model-attacks, so those two clusters remain PITAX-only.

Log

See log.