A Systematic Survey of Prompt Injection Attacks and Defenses in LLM-Integrated Applications and Agentic Systems

Abstract

Prompt injection (PI), listed as LLM01:2025 by OWASP, converts a data-representation problem into an execution-control problem: untrusted content is processed alongside privileged instructions, while large language models lack a native instruction/data boundary. Unlike jailbreaking, which primarily targets content-safety policies, PI targets application control flow and can induce unauthorized tool calls, information disclosure, or persistent-state corruption. This Systematization of Knowledge (SoK) studies PI from a provenance and information-flow perspective. It contributes (1) a three-tier attack taxonomy organized by contamination vector, attacker capability, and persistence; (2) a critical comparison of four defense lines and their trust assumptions; and (3) a cross-benchmark reporting audit together with Safe Utility Ratio (SUR), a metric for exposing security gains obtained by sacrificing task utility. We formalize PI as low-integrity data influencing high-integrity control flow, separate this integrity failure from subsequent confidentiality leakage, and identify evidence gaps in adaptive and stateful-agent evaluation.