PIP-004
Authority impersonation
Injected text imitates the formatting and tone of a system or developer message so it inherits the authority of one.
How it works
The attacker mimics whatever markers a system message carries in that application: a label, a delimiter, an all-capitals notice, an internal-sounding identifier. The model has no way to verify the provenance of a marker it only ever sees as text.
Why it works
Authority in a prompt is conveyed by convention, and conventions are copyable. Everything the model uses to recognise a privileged instruction is available to whoever can write into its context.
What it looks like
A block styled as an internal notice, compliance requirement, or updated operating instruction, typically asserting urgency or mandatory compliance to discourage the model from treating it as ordinary content.
Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.
Defences
Use markers the attacker cannot reproduce
Raises cost
Delimit trusted instructions with unpredictable, per-request identifiers rather than fixed conventional markers, and strip any occurrence of them from untrusted content before assembly.
Never grant standing on formatting
Architectural
Do not let a system make decisions on the basis of text claiming to be authoritative. Authority should come from the channel content arrived on, which the application knows and the model does not.
Framework mapping
- LLM01:2025 · OWASP LLM Top 10
- AML.T0051 · MITRE ATLAS
Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-08-03.