text: Prompt injection against LLMs. Prompt injection is a class of attacks against LLMs in which the adversary manipulates 
  the prompt, i.e., the textual input fed directly to the LLM, causing the LLM to generate outputs that satisfy some adver- 
  sarial objective [50, 64]. Evasion attacks as discussed above can use prompt injection, jailbreaking attacks being a widely 
  explored example in which the adversary aims to bypass some safety guardrail included in the LLM system, such as “do 
  not output expletives” [23, 42, 54, 66, 72, 73]. 
  
  Prompt injection is also used for extraction attacks that aim to infer some information from or about the model, for 
  example, the system prompt [50, 54, 70], training data samples [46], or model parameters [18]. In indirect prompt injection 
  attacks [33], the adversaries do not directly interact with the target LLM, and instead inject adversarial inputs into third- 
  party data, which is then added to the LLM prompt (intentionally or unintentionally) by the victim application and/or its 
  users. This relates to another category of attacks that target LLM-based applications, such as RAG systems, and invalidate 
  their integrity by exploiting the weaknesses of the underlying LLM [19, 55]. 