How Prompts Work
Prompting
Every adversarial technique exploits a prompting mechanism. Role hijacking works because role prompting works. Few-shot attacks work because in-context learning works. You can't break what you don't understand. This section teaches each concept twice: how it works constructively, and how it gets exploited.
System vs User Prompts
How LLMs receive layered instructions through system and user prompts. The split that creates the primary attack surface for prompt injection.
Role & Persona
How role prompting shapes model behavior by assigning identities. The same mechanism that makes models helpful also makes persona-based jailbreaks possible.
Few-Shot Learning
How models learn patterns from examples in the prompt. The same in-context learning that enables demonstrations also enables behavioral steering attacks.
Chain of Thought
How step-by-step reasoning changes model output. The same decomposition that improves accuracy also creates exploitable reasoning paths.
Output Format Control
How specifying output format changes model behavior. The same format constraints that produce structured responses also suppress refusals and extract information.
Context & Attention
How models handle context windows and distribute attention across tokens. The same attention mechanics that enable long conversations also enable dilution and distraction attacks.
Structural Delimiters
How formatting and delimiters create boundaries in prompts. The same structural conventions that organize instructions also define where injection boundaries can be exploited.
Instruction Hierarchy
How models prioritize conflicting instructions from different sources. The same priority system that maintains safety also creates exploitable authority gradients.