Test whether the injection actually reaches a critical workflow.
The threat
a user forces the model to ignore its instructions by asking directly in the conversation (ignore previous instructions).
Blind spotWhy classic frameworks miss it
frameworks do not model a conversation input whose content has authority over the processing engine's behavior.
MitigationProposed approach
compartmentalize instructions (system or user separation) and above all test whether the injection actually reaches a critical workflow: if the toxic output is blocked downstream, the threat is contained.
The proposed control
no unfiltered output reaches a critical workflow.
Expected evidence
the trajectory of an injection up to an effect on the decision path (or a block).
SourcesReferences and public research
MITRE ATLAS 2026.07AML.T0051.000 Direct
OWASP GenAIOWASP GenAI LLM01:2025 Prompt Injection
Public researchPublic research sources: MITRE ATLAS 2026.07 (verified technique mapping), OWASP GenAI, and the public risk-voicebot (aivansoul/risk-voicebot) template defining the 20 checkpoints. No client registry data: generic card, no rating, no verdict.