SoK: PIAtlas: Decomposing the Unbounded Prompt Injection Attack Space

What it is

PIAtlas is a taxonomy of prompt injection by construction: how the injected text is built to subvert the model. It was written by Stavros Damianakis and Konstantinos Psounis (University of Southern California), arXiv 2610.24999v1, 18 October 2026. It has six root classes (F1 to F6), each tied to one model property and to the defense that targets it, with techniques and sub-techniques below them. The authors also release PICorpus, which merges twenty public datasets into over 440,000 deduplicated, license-clean attack instructions. Code and data are at github.com/stevendamianakis/piatlas, and an interactive taxonomy is at stevendamianakis.github.io/piatlas-site/.

How it works

The paper models what an LLM does before acting on an instruction as six decisions, each reading one part of the text: the instruction itself, the apparent source, legibility to inspection, the reason to comply, the situation (world or role), and the form of the response. A class is a way of changing one of those parts while the request stays the same. The fetched text names only some classes:

• F2 is Structural Spoofing, which formats text to look like it came from a higher-authority channel such as the system prompt.
• F3 covers non-semantic sequences.
• F5 covers personas.
• F6 covers refusal suppression.

F1 and F4 are not named in the text available.

The scope is deliberately narrow. Delivery (channel, modality, rendering, turn structure), goal (exfiltration, prompt leak, harmful content) and search method (PAIR, TAP, genetic, gradient) are excluded. Direct versus indirect placement is kept as metadata. Dedicated jailbreak benchmarks with no instruction context to override are excluded. Real attacks are multi-label, so composition is treated as a property of the data.

The authors also embed attack templates, cluster them without labels, and compare the clusters with PIAtlas labels. An encoder instructed to represent how a prompt is constructed, not what it asks for, reaches chance-corrected agreement about halfway between chance and a perfect match. The same encoder without the instruction scores clearly lower.

What to do

• Tag red-team findings and benchmark items with PIAtlas techniques, so coverage gaps show up by mechanism and not by delivery vector or goal.
• Use PICorpus as a source of labelled attacks.
• Check agent benchmarks against the taxonomy. The authors report that widely used ones test only part of the space.
• In adaptive testing, expect attackers to favor mechanisms that curated benchmarks underrepresent. In the LLMail-Inject competition they did.

Caveats

• The authors call the six-class coverage a falsifiable hypothesis, not a closed guarantee, and say the taxonomy will be updated as new exploits appear.
• Labels for "thousands" of PICorpus records come from an LLM pipeline with human verification, not for the whole 440,000.
• The authority tiers in Table II summarize several vendor documents and are not a standard.
• The fetched text stops in Section II, so the per-benchmark coverage numbers, the 44-scheme mapping and the incident analysis are not available here.