Summary: A 70-technique catalogue of prompt injection and jailbreak methods, each with aliases, variations and worked examples, maintained by Jason Haddix / Arcanum Information Security.
Sources: raw/AI-attack-techniques/index.md, raw/AI-attack-techniques/PIT-T-01..70-*.md
Last updated: 2026-07-28
PITAX v1.6.1 catalogues 70 prompt-injection attack techniques, coded PIT-T-01 through PIT-T-70 (source: index.md). Each technique file carries a stable code, a snake_case ID, a delivery classification, a description, aliases mapping the technique to academic and vendor naming, variation ideas, and concrete example payloads.
Licensed CC BY 4.0 (source: PIT-T-01-act-as-interpreter.md and every other technique file).
What the taxonomy is good for
The aliases field is the most valuable part for research work. A single technique typically carries three to six names across academia, vendor blogs and other taxonomies — for example Output Priming is simultaneously “Prefix Injection” (Wei et al., arXiv 2307.02483), “Output Seeding / Leading Response / Forged Affirmation” (Pangea PT0059-61) and “Response Priming” (HiddenLayer APE) (source: PIT-T-49-output-priming-prefix-injection.md). PITAX is effectively a Rosetta stone between the naming conventions of HackAPrompt, Pangea, HiddenLayer APE, MITRE ATLAS, OWASP and the arXiv literature.
Delivery classification
Every technique is tagged direct, indirect, or both — see delivery-direct-vs-indirect.
How this wiki clusters the 70
The raw index is a flat list. These pages group techniques by the mechanism they exploit, which is how you actually reason about defences:
| Cluster page | Techniques |
|---|---|
| multi-turn-attacks | T29, T30, T31, T32, T33, T66, T69 |
| context-and-role-forgery | T07, T31, T48, T49, T51, T52, T53, T56 |
| agentic-and-tool-attacks | T42, T43, T45, T46, T47, T53, T65, T69, T70 |
| retrieval-and-memory-poisoning | T12, T13, T32, T44, T45, T64 |
| automated-attack-generation | T09, T39, T40, T41 |
| obfuscation-and-encoding | T03, T06, T10, T11, T16, T19, T23, T24, T26, T28, T54, T68 |
| reasoning-model-attacks | T04, T05, T25, T52, T55, T61, T62, T63 |
| persuasion-and-framing | T01, T02, T08, T14, T15, T17, T18, T20, T21, T22, T27, T34, T35, T36, T37, T38, T50, T57, T66, T67 |
| weight-level-attacks | T09, T58, T59 |
| baseline, no cluster | T60 — see below |
All 70 techniques are covered. Techniques appear in more than one cluster where the mechanism genuinely spans both. T31 (History Fabrication) is both a multi-turn technique and a role-forgery technique; that is a property of the attack, not a filing error.
The baseline that is easy to skip
PIT-T-60 Direct Request is the control case: “simply asking the model to do the thing, in plain language, with no obfuscation, framing, role-play, or trick… a large share of real-world successful attacks use no technique at all. Always the first thing to try, and the control case for judging whether a fancier technique was even necessary” (source: PIT-T-60-direct-request-plain-prompting.md).
Any evaluation of a sophisticated technique that does not run T60 as a control cannot claim the technique did anything.