PIP-009
Payload splitting
The instruction is fragmented across turns or documents so that no single piece is recognisable on its own.
How it works
Each fragment is innocuous in isolation; the model assembles them from context. Where a filter inspects one message or one passage at a time, it never sees the complete instruction.
Why it works
Models integrate context across an entire conversation or prompt, while most inspection operates on individual units. The mismatch is the vulnerability.
What it looks like
Several benign-looking fragments, distributed across turns or across documents likely to be retrieved together, with a final instruction to combine them.
Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.
Defences
Inspect the assembled context
Raises cost
Evaluate the full context as constructed rather than each message as it arrives. This is the only inspection point where the complete instruction exists.
Constrain conversation-derived authority
Architectural
Do not let accumulated conversation state expand what a system may do. If capability is fixed by configuration, assembling an instruction across turns achieves nothing.
Framework mapping
- LLM01:2025 · OWASP LLM Top 10
- AML.T0051 · MITRE ATLAS
Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-08-03.