{
  "taxonomy_version": "1.0",
  "project": "prompt_injection_security_eval",
  "attack_surfaces": [
    {
      "attack_surface": "direct",
      "description": "User-supplied prompts that try to override or redirect model instructions.",
      "families": [
        "direct_instruction_override",
        "goal_hijacking",
        "roleplay_bypass"
      ]
    },
    {
      "attack_surface": "indirect",
      "description": "Injected instructions hidden inside external content such as retrieved documents or tool output.",
      "families": [
        "retrieved_content_injection",
        "context_smuggling",
        "semantic_separation"
      ]
    },
    {
      "attack_surface": "leakage",
      "description": "Attempts to expose hidden prompts, policies, internal instructions, or private context.",
      "families": [
        "system_prompt_extraction",
        "policy_disclosure",
        "instruction_leakage"
      ]
    },
    {
      "attack_surface": "adaptive",
      "description": "Multi-turn or iterative attacks that change based on model responses.",
      "families": [
        "iterative_refinement",
        "response_adaptation",
        "multi_turn_probe"
      ]
    },
    {
      "attack_surface": "tool_mediated",
      "description": "Attacks that target tool-using or agentic workflows.",
      "families": [
        "tool_abuse",
        "action_hijacking",
        "environment_manipulation"
      ]
    }
  ],
  "labels": [
    "prompt_leakage",
    "instruction_override",
    "goal_hijacking",
    "unsafe_tool_action",
    "benign",
    "failed_attack"
  ]
}