Attack Classification System for AI red teaming and penetration testing.
0Total Entries
0Intents
0Techniques
0Evasions
0Inputs
Direct delivery Indirect delivery EitherLOCAL Requires local model-weight access (click a card to learn more)
Attack Intents
Goals and objectives of prompt injection attacks
Attack Techniques
Methods used to execute prompt injection attacks
Attack Evasions
Obfuscation methods to avoid detection
Attack Inputs
Attack surfaces and input vectors for injection
Prompt injection can occur both directly (user input) and indirectly (via external data sources). This section captures interesting attack surfaces and input vectors for prompt injection attacks.
Local access required. This is a white-box, or "local," attack: it only works when you control the model itself: its weights, gradients, tokenizer, activations, or decoding internals, typically a self-hosted, open-weight, or on-premise model. It cannot be run against a black-box target reached only through a hosted API or chat interface, which expose inputs and outputs but never the internals. Most real-world AI red-team engagements are black-box, so these are "lab attacks": valuable for research, model evaluation, and assessing open-weight deployments, but out of scope when you cannot load the model yourself. Examples include gradient / greedy-coordinate attacks (GCG and kin), abliteration (ablating the refusal direction), activation steering / representation engineering, fine-tuning away safety, and logit / decoding manipulation. If your target self-hosts an open-weight model, these come back into scope.