{
  "source_file": "0930",
  "source_platform": "Dev.to",
  "author": "Arun Kumar",
  "title_listed": "If nothing was concatenated, it isn't prompt injection",
  "keywords": "",
  "domain": "大模型算法",
  "content_type": "深度技术解析",
  "is_paid_flag": "否",
  "url": "https://dev.to/narotra05hp/if-nothing-was-concatenated-it-isnt-prompt-injection-jo9",
  "publish_date": "2026-09-28",
  "corpus_stage": "",
  "notes": "",
  "id": "a5be21663865",
  "collected_at": "2026-10-02T13:54:48",
  "title": "If nothing was concatenated, it isn't prompt injection - DEV Community",
  "body_markdown": "Most write-ups treat prompt injection and jailbreaking as the same attack with two names. They aren't, and the person who coined the term has a one-line test that settles almost every case.\nIt matters because the two attacks live at different layers, so the defences don't transfer. Build a jailbreak defence against an injection problem and you've spent the effort for nothing.\nThe test\nFrom Simon Willison's post, March 2024:\nCrucially: if there's no concatenation of trusted and untrusted strings, it's not prompt injection. That's why I called it prompt injection in the first place: it was analogous to SQL injection, where untrusted user input is concatenated with trusted SQL code.\nThat's the whole test. Did untrusted input get glued into a prompt your developer wrote? Then it's injection. Did someone just argue the model out of its own guardrails in a chat window? Then it's a jailbreak.\nHe defines the two separately. Prompt injection is \"a class of attacks against applications built on top of Large Language Models (LLMs)\", which \"work by concatenating untrusted user input with a trusted prompt constructed by the application's developer.\" Jailbreaking is \"the class of attacks that attempt to subvert safety filters built into the LLMs themselves\".\nRead those side by side and the split is clean. One attacks your application. The other attacks the model.\nWhy the distinction does work\nA jailbreak is a conversation problem. One person, one chat window, pushing against a filter until it gives. No second party, no external document, no tooling. The defence lives inside the model — it's alignment training, and it isn't yours to fix.\nPrompt injection is an architecture problem. Something untrusted — a user, a file, a fetched web page — ends up concatenated into a prompt that also contains your instructions and, often, your credentials. The defence lives in how you build the application, which\nis\nyours to fix.\nThe stakes differ too, and Willison is direct about it. A jailbreak risks embarrassment, or at worst helping someone do something harmful. Prompt injection threatens applications holding confidential data and tools. Those aren't the same exposure.\nWorth noting he doesn't claim it's solved. He's proposed patterns like Dual LLM, but by his own account prompt injection remains an open problem. Anyone selling you a complete fix is ahead of the person who named the thing.\nWhere the authorities actually disagree\nHere's the part that trips people up, and it's not a case of someone being wrong.\nOWASP draws the boundary differently. In its taxonomy, jailbreaking sits\nunderneath\ndirect prompt injection — one of two sub-classes, alongside indirect injection. Willison keeps jailbreaking in its own category entirely.\nSo the same clever chatbot prompt gets two different names depending on which taxonomy you're following. Neither is careless. They're organised for different purposes: Willison's split is about where the vulnerability lives, OWASP's is about cataloguing a risk surface.\nWhat matters is knowing which one your team means when someone says \"we handled prompt injection\" in a review. That sentence carries two different scopes.\nWhich one you're actually facing\nThe concatenation test answers it fast. Ask where the malicious text came from.\nIf it arrived in the user's own message and the attacker is the user, you're looking at a jailbreak. If it arrived inside data your application fetched and pasted into a prompt — a support ticket, a scraped page, a PDF, a tool result — that's injection, and the attacker may never touch your app directly.\nThat last case is the one worth sitting with. Indirect injection doesn't need access to the victim's session at all. Someone poisons a document, your app reads it, your prompt concatenates it. Nobody had to log in as anyone.\nIf you take one thing: when a model can read untrusted data\nand\ncall tools, you own an architecture problem, and no amount of model-side safety training will close it for you.\nLonger version with the full comparison table at\ndiffstudy.com\n. Quotes from Simon Willison,\n\"Prompt injection and jailbreaking are not the same thing\"\n, 5 March 2024.",
  "metadata": {
    "title": "If nothing was concatenated, it isn't prompt injection - DEV Community",
    "description": "Most write-ups treat prompt injection and jailbreaking as the same attack with two names. They... Tagged with security, llm, cybersecurity, ai.",
    "keywords": "security, llm, cybersecurity, ai, software, coding, development, engineering, inclusive, community",
    "author": null,
    "og:type": "article",
    "og:url": "https://dev.to/narotra05hp/if-nothing-was-concatenated-it-isnt-prompt-injection-jo9",
    "og:title": "If nothing was concatenated, it isn't prompt injection",
    "og:description": "Most write-ups treat prompt injection and jailbreaking as the same attack with two names. They...",
    "og:site_name": "DEV Community",
    "og:image": "https://media2.dev.to/dynamic/image/width=1200,height=627,fit=cover,gravity=auto,format=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F250y4a39u97ypj6oc2fq.png",
    "twitter:site": "@thepracticaldev",
    "twitter:creator": "@",
    "twitter:title": "If nothing was concatenated, it isn't prompt injection",
    "twitter:description": "Most write-ups treat prompt injection and jailbreaking as the same attack with two names. They...",
    "twitter:card": "summary_large_image",
    "twitter:widgets:new-embed-design": "on",
    "twitter:image:src": "https://media2.dev.to/dynamic/image/width=1200,height=627,fit=cover,gravity=auto,format=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F250y4a39u97ypj6oc2fq.png"
  },
  "paywall": {
    "listed_paid": false,
    "detected": false,
    "marker": "",
    "public_only": false,
    "policy": "付费/会员内容只保留页面公开可见部分，不绕过付费墙"
  },
  "crawl": {
    "success": true,
    "status_code": 200,
    "error": ""
  },
  "code_blocks": [],
  "images": [],
  "audio": [],
  "videos": [],
  "links": [
    {
      "href": "https://diffstudy.com/prompt-injection-vs-jailbreaking/",
      "label": "diffstudy.com",
      "type": "a"
    },
    {
      "href": "https://simonwillison.net/2024/Mar/5/prompt-injection-jailbreaking/",
      "label": "\"Prompt injection and jailbreaking are not the same thing\"",
      "type": "a"
    }
  ],
  "repair_version": 2,
  "repaired_at": "2026-10-14T10:48:58Z",
  "source_url": "https://dev.to/narotra05hp/if-nothing-was-concatenated-it-isnt-prompt-injection-jo9",
  "papers": [],
  "actual_video_files": [],
  "body_chars": 4160,
  "expected_body_images": 0,
  "discovery_status": "ok",
  "delivery_status": "ok",
  "missing_reason": "",
  "raw_html": "attachments/a5be21663865/pages/source.html",
  "local_html": "attachments/a5be21663865/pages/article.html",
  "body_base_path": "attachments/a5be21663865/pages/",
  "body_markdown_path": "attachments/a5be21663865/pages/article.md"
}