Prompt Injection vs Jailbreak
A jailbreak targets the model's own safety training, trying to make it produce content it was trained to refuse. Prompt injection targets an application, smuggling instructions into the model's input, often through data it processes, so that they override the developer's instructions.
Definitions
- Prompt Injection PTL-0087
- Prompt injection is an attack in which text supplied to a language model, by a user or through data the model processes, contains instructions that override or subvert the instructions of the application's developer.
- Jailbreak PTL-0090
- A jailbreak is a prompt crafted to make a model produce outputs its safety training is meant to prevent, often through role-play, hypothetical framing, obfuscation, or other adversarial techniques.
Differences
| Prompt Injection | Jailbreak | |
|---|---|---|
| What is subverted | The application developer's instructions | The model's safety behavior |
| Typical attacker | A third party whose text reaches the model, such as a web page or email | Usually the user talking to the model |
| Main risk | Data exfiltration and unwanted actions by agents with tools | Harmful or disallowed output |
| Analogy | SQL injection | Getting around a policy |
Which to use
- Treat prompt injection as an application security problem, with defenses such as limiting tool permissions and isolating untrusted data.
- Treat jailbreaks as a model safety problem, addressed by safety training, classifiers and guardrails.
Sources
- Willison (2022). Prompt injection attacks against GPT-3.
- Perez & Ribeiro (2022). Ignore Previous Prompt: Attack Techniques For Language Models.
- Wei et al. (2023). Jailbroken: How Does LLM Safety Training Fail?.
Cite this page
Protologue. (2026). Prompt Injection vs Jailbreak. In Protologue: A Taxonomy of Prompting and LLM Techniques (v1.4.0). https://protologue.com/compare/prompt-injection-vs-jailbreak/