PIP-001
Instruction override
Text that directly instructs the model to disregard everything it was told before it.
How it works
The attacker supplies text asserting that the preceding instructions are void, superseded, or were a test, then states the instructions to follow instead. No technical exploit is involved: the model is asked to prefer one set of instructions over another, and it obliges.
Why it works
Instructions and input arrive in one undifferentiated context. Nothing marks which text came from the developer and which arrived from outside, so precedence is decided by what reads as most authoritative rather than by where it came from.
What it looks like
A short imperative preamble asserting that prior instructions no longer apply, followed by the replacement instruction. It is the crudest form and the one most likely to be caught, which is why it is rarely used alone against a well-built system.
Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.
Defences
Separate instructions from data structurally
Raises cost
Place untrusted content in a dedicated field the model is trained to treat as data rather than concatenating it into the instruction text. This does not make the boundary absolute, but it is the difference between a boundary that exists and one that does not.
Constrain what the response can cause
Architectural
Scope the actions available on the strength of a model output. If the worst case of a successful override is a wrong answer rather than an action, the attack has somewhere to land but nothing to do.
Filter for override phrasing
Do not rely on
Pattern matching on familiar phrasings catches unsophisticated attempts and generates useful telemetry. It is trivially defeated by rephrasing, so treat it as a volume reducer and a signal, never as a control.
Framework mapping
- LLM01:2025 · OWASP LLM Top 10
- AML.T0051.000 · MITRE ATLAS
Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-08-03.