Prompt Injection Techniques: The Three Tiers of Evasion

The prompt injection most likely to reach your production data is a plainly written sentence asking your agent to do something it is already allowed to do.

No hidden characters. No override phrasing. Correct grammar. It sits in a support ticket or a wiki page the agent retrieves during normal work, and it clears every control you own because there is nothing in it to catch.

That sentence sits at one end of a spectrum, and the spectrum is what your coverage actually depends on. Techniques vary in how much evasion they have to perform before an instruction lands, and that variable predicts what your stack will see far better than where the payload entered. OWASP’s LLM01 defines the risk class without sorting it by what any of it costs to detect.

So sort it. Three tiers, and only one of them is invisible.

Technique Lists Inherited Their Structure From the Chatbot Era

OWASP put jailbreaking inside the prompt injection category, and the downstream literature followed.

The 2023 to 2024 LLM01 entry names direct prompt injection as jailbreaking outright. The current revision files jailbreaking as a form of prompt injection, describing it as input that causes a model to disregard its safety protocols. Both readings place alignment attacks inside the injection taxonomy, and both are defensible for a chatbot. Neither survives contact with an agent.

The research keeps the two apart when it has to be precise about mechanics. Payload splitting, ciphers, character reordering and adversarial suffixes are classified as jailbreak lineage because what they attack is the alignment surface. The foundational work on injection techniques targets something else: the model’s inability to hold its operator’s instruction above the text it is asked to process.

An injection against a production agent has no refusal to argue with. The attacker wants the agent to call a tool it is permitted to call, against data it is permitted to read, with an argument the schema accepts. Nothing in that sequence triggers a safety protocol, because nothing in it is unsafe on its own. Practitioners working on retrieval-augmented systems note the practical consequence: injection tends to succeed more readily than jailbreaking, because instruction-following training is universal across models while refusal training is targeted at specific harms.

So a catalog built in the chatbot era spends most of its entries on a boundary your attacker has no reason to touch. The categories do overlap, and an attacker who can jailbreak your model can often hurt your agent through it. That overlap is not where your coverage gap lives.

Sort Prompt Injection Techniques by What Each One Has to Defeat

The sorting variable is required evasion: how much work a technique has to do before the instruction lands.

That question produces three tiers, and every technique in the standard catalog falls into exactly one of them.

Technique	What it must defeat	Attacker precondition	Artifact on the prompt plane
Tier 1 · Defeats the refusal boundary
Persona and role framing	Alignment	Input access	Persona vocabulary, explicit framing
Hypothetical and virtualization framing	Alignment	Input access	Framing scaffold
Cipher and word-substitution encoding	Alignment plus filter	Input access	High-entropy or substituted text
Character-order manipulation	Alignment plus filter	Input access	Malformed token sequences
Adversarial suffix	Alignment	Input access, tuning access	Nonsense token string
Tier 2 · Defeats the instruction hierarchy or an input filter
Explicit override phrasing	Instruction hierarchy	Any writable channel	Override imperative
Fake response or completion spoofing	Instruction hierarchy	Any writable channel	Forged turn structure
Role forgery in message history	API structure	API-level access	Mismatched role attribution
Payload splitting across turns	Single-input filters	Repeated access	Fragments, individually clean
Base64, multilingual, emoji encoding	Filter lexicon	Any writable channel	Encoded block
Zero-width, CSS-hidden, white-on-white text	Human review	Control of retrieved content	Invisible characters
Multimodal placement in image or audio	Text-only inspection	Control of an ingested asset	None in text
Tier 3 · Defeats nothing
Plain authorized request in retrieved content	Nothing	Control of any source the agent reads	None

Tier 1 takes up most of the room in published catalogs and does the least work against an agent. Every entry is an attack on model alignment, and an attacker who wants your agent to export a customer table does not need your model to break character to do it.

Tier 2 is where defensive spending lands, and the spending is justified. Every Tier 2 technique carries evidence of its own evasion inside the payload. An override imperative has to say something that reads as an override. An encoded block has to be encoded. Hidden text has to be hidden, which is itself a detectable property. The technique and the signal arrive together.

Tier 3 has one row because it needs one. The technique is an ordinary sentence, written in plain language, asking for something the agent is allowed to do. MITRE ATLAS files the whole family under a single identifier, AML.T0051, which is accurate as a catalog entry and silent on what any of it costs to detect. Mapping those identifiers onto runtime evidence is where the split between tiers becomes operational.

Here is the useful part. The ledger turns an open-ended list that grows every quarter into three closed classes, and only one has to be reasoned about per agent. Tier 1 and Tier 2 are model and pipeline properties, answered once for the platform. Tier 3 is a permissions property, answered per agent, and answering it is finite work.

Detection Rate Is a Property of the Tier

The ledger makes a prediction: a text-plane classifier scores in proportion to how much lexical evidence each technique is forced to carry.

The benchmark record supports it. Liu et al. at USENIX Security 2024 built the standard evaluation framework for injection attacks and defenses, and identified the gap directly: defenses perform against attacks that announce themselves and degrade against attacks that do not. Later work reproduces the shape with numbers attached. An evaluation across the Liu benchmark, Garak, and InjecAgent, totalling 8,276 attack prompts held out from detector design, reports roughly ninety-two percent detection on explicit-override attacks and roughly ninety-nine percent on data-exfiltration attacks, against a plateau of thirty-five to forty-five percent on subtle indirect injection where the embedded instruction carries no override keywords.

Read the plateau carefully, because its shape is the finding. It reproduces across three independently constructed benchmarks, which is the signature of a property belonging to the attack class rather than a tuning deficiency belonging to one detector. Adaptive attack research points the same direction: published indirect-injection defenses were bypassed at attack success rates above fifty percent once the attacker was allowed to write against the defense.

The tier argument also sits underneath the choice of signal, since the four categories of prompt-layer signal fail differently and none of them can score evidence a technique was never forced to produce. So the detection rate your vendor reports is an average over a technique mix, and the mix is dominated by tiers that are cheap to catch. A classifier scoring ninety-four percent overall can be scoring near zero on the tier that reaches your production data, which is why the numbers worth asking a detection model for are not the headline ones.

Averages hide tiers. That is why the sort matters before the score does.

Tier 3 Has a Name, and It Is Coercion

Coercion is what happens when a trusted prompt redirects an agent’s authorized capability without breaking a single control.

The agent is permitted to read the support ticket. The agent is permitted to call the customer lookup tool. The agent is permitted to send a summary through the notification channel. Each step passes its own check. The sequence is the attack, and no control in the path was designed to evaluate sequences.

Severity here is a permissions variable. Take one Tier 3 sentence and put it in front of two agents. The first has read-only retrieval and can do nothing with the instruction beyond returning text. The second holds a write-scoped API tool and a service account with real reach, and the same sentence becomes tool misuse with a legitimate identity attached. Identical technique, identical payload, two different incidents.

That relationship is why Tier 3 grows without attacker effort. Every tool you attach to an agent adds authorized actions, and every authorized action adds Tier 3 payloads that need no new technique to reach it. Your attack surface expands on your own release schedule.

Architecture narrows the tier without closing it. The published design patterns lock which tool fires and in what order, and the authors concede in eight of ten worked case studies that the arguments those calls carry stay influenceable, the same residual the highest-scoring MCP tool poisoning paradigm exploits by changing one argument on a call the agent was already making.

Tier 3 payloads also skip every hiding mechanism in the catalog, because they have nothing to hide. Zero-width characters and concealed text exist to get a suspicious instruction past a human reviewer. A visible, polite, grammatically normal sentence in a support ticket has already cleared that bar. The pattern holds across the named incidents on the public record, where the vendor fix repeatedly closed the exfiltration channel and left the instruction path untouched.

So run the deletion test on whatever technique list your team works from. Delete every entry whose payload has to contain an imperative that reads as an override. Delete every entry whose payload has to be encoded, obfuscated, or hidden. What survives is the set your classifier will not score, and it is the set that expands every time you widen an agent’s tool scope.

The Action Plane Carries the Evidence the Prompt Plane Never Had

When the technique leaves nothing in the text, the only remaining record is what the agent did.

That record has to be scoped to the individual agent to be worth anything. A database call is routine for a reporting agent and anomalous for a ticket summarizer. A connection to an internal service is expected from one deployment and unprecedented from another. Fleet-wide rules cannot express that difference, which is why generic runtime alerting produces noise on AI workloads and then gets tuned down until it produces nothing. It also has to resolve to one agent rather than one pod, and how far down your stack that attribution reaches sets a ceiling on everything above it.

ARMO builds a per-agent behavioral profile called Application Profile DNA (APD™) from what each workload actually does in execution, and evaluates deviation against that workload’s own recorded behavior. The question the platform answers is narrow: has this agent stopped behaving like itself. A Tier 3 sequence is invisible as text and loud as behavior, because the tool call it produces has no precedent in the profile it is measured against, which is the same comparison that surfaces intent drift when an agent’s authorized actions stop resembling its own. That is the detection surface built for AI workloads when the prompt plane has nothing to offer.

The obvious objection is that behavioral enforcement breaks production. Audit and Enforce answers it by sequencing. The sensor observes first and records the profile. You review what enforcement would have blocked against real traffic. Only then does the policy arm, per agent, with evidence behind it. That is the whole content of progressive enforcement for agent workloads, and promoting a constraint from alerting to blocking once the evidence says it is safe is what makes a behavioral control defensible to the team whose production it governs.

Detection is not containment, and the interval between them is where a Tier 3 payload finishes its work. We have previously walked the production detection chain for prompt injection against agent workloads end to end, and sized the response clock that decides whether the data had already left.

Two bounds belong on this. Credential isolation constrains what a coerced agent can reach and what leaves the environment, and it does nothing to stop the coercion. And a patient Tier 3 payload that stays inside an agent’s recorded envelope is the residual case behavioral deviation will not surface, which is why the permissions work in the previous section is not optional.

A Technique List Is a Coverage Map for Two Tiers Out of Three

Your technique list is accurate about everything that has to work for its entry, and silent about the one thing that walks in.

Expect that asymmetry to widen. New evasions are publishable, so Tier 1 and Tier 2 keep accumulating rows, and a plain sentence asking for an authorized action will never be a paper. The tier with no technique in it stays one line in the catalog while becoming a larger share of what reaches production.

Knowing which tier you cover is what lets you widen an agent’s tool scope deliberately. Teams that can answer the coverage question ship more agent capability, because they can price each new tool against a threat model they can name.

Watch a demo of behavioral detection against a coerced agent in Kubernetes.

Frequently Asked Questions

Is jailbreaking the same as prompt injection? OWASP groups them under LLM01, and for a chatbot the grouping works, since both arrive as crafted input to a model. For an agent they separate by target. Jailbreaking attacks the refusal boundary and needs the model to abandon a safety behavior. Injection against an agent attacks the instruction hierarchy or nothing at all, and the action it produces is one the agent was already permitted to take.

Which prompt injection techniques should we test first for an agent with tool access? Start with Tier 3, because it is the tier your existing controls were never built to score and it is fast to construct. Write a plain-language instruction requesting an action inside the agent’s tool scope, place it in a document or ticket the agent retrieves in normal operation, and watch whether anything in your stack produces a signal. Then move to Tier 2 to confirm your classifier performs as advertised on the techniques it was tuned for.

Can an input classifier be tuned to catch Tier 3 payloads? Not without an unusable false positive rate. A Tier 3 payload is lexically identical to a legitimate request, so any classifier sensitive enough to flag it will also flag the ordinary instructions your users write every day. Sorting published defenses by where each one sits relative to the agent’s decision shows which layer is actually available to you for this tier.

How do we tell a coerced agent apart from an agent doing unusual work legitimately? Correlate the behavioral deviation with infrastructure events. Legitimate change in agent behavior tracks deployments, image updates, configuration pushes and tool additions, and those leave records. Behavioral change with no corresponding infrastructure event is the discriminator worth alerting on, and it is worth budgeting for the interval before a new agent’s baseline is dense enough to enforce against.

Does isolating agent credentials solve this? It bounds the damage without addressing the cause. Credential isolation limits what a coerced agent can reach and what leaves your environment, which reduces the blast radius of a successful Tier 3 attack considerably. The coercion still happens, the agent still executes an authorized action it was manipulated into taking, and in a multi-agent system the output of a coerced agent becomes another agent’s trusted input.