07. References, Standards & CVE Index
This document provides an authoritative catalog of security standards, industry frameworks, seminal academic research papers, MITRE ATLAS techniques, and real-world CVE vulnerability records for LLM Prompt Injection and Generative AI Security.
1. Industry Standards & Frameworksβ
A. OWASP Top 10 for LLM Applications (2025 Edition)β
- LLM01:2025 - Prompt Injection: Primary vulnerability class covering Direct Prompt Injection (Jailbreaking) and Indirect Prompt Injection (Data Poisoning).
- LLM02:2025 - Sensitive Information Disclosure: Disclosing sensitive operational PII, system prompt instructions, or internal infrastructure tokens.
- LLM07:2025 - System Prompt Leakage: Unauthorized extraction of proprietary prompt directives and embedded operational rules.
B. NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0)β
- NIST AI RMF 1.0 (NIST SP 1270): Standardized guidelines for managing risk, safety, transparency, and trustworthiness across machine learning deployments.
C. MITRE ATLASβ’ (Adversarial Threat Landscape for Artificial-Intelligence Systems)β
- AML.T0051 - LLM Prompt Injection: Direct and indirect injection payload execution against LLM agents.
- AML.T0054 - LLM Data Poisoning: Injecting malicious instructions into training sets, RAG document vector stores, or fine-tuning datasets.
2. Key Academic & Research Papersβ
-
Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
- Authors: Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, Mario Fritz (2023).
- Contribution: Introduced the formal threat model and taxonomy for Indirect Prompt Injection, demonstrating real-world attacks against search engines, email assistants, and agent workflows.
- arXiv:2302.12173
-
Universal and Transferable Adversarial Attacks on Aligned Language Models
- Authors: Andy Zou, Zifan Wang, J. Zico Kolter, Matt Fredrikson (2023).
- Contribution: Discovered automated Greedy Coordinate Gradient (GCG) suffix generation techniques that reliably break safety alignment across commercial LLMs.
- arXiv:2307.15043
-
Formalizing Indirect Prompt Injection Attacks in Language Model Integrated Applications
- Authors: Jingwei Yi et al. (2024).
- Contribution: Detailed mathematical modeling of token attention shifts during prompt injection execution in transformer decoders.
3. Notable Real-World CVEs & Incidents Catalogβ
| CVE ID / Incident | Vulnerable Component | Attack Vector | Technical Impact |
|---|---|---|---|
| CVE-2023-43770 | LangChain SQL Database Chain | Indirect Prompt Injection | Remote Code Execution & Arbitrary SQL Execution |
| CVE-2023-29374 | LangChain Python Exec Tool | Direct Prompt Injection | Arbitrary Python Code Execution |
| Microsoft Copilot Data Theft (2024) | Copilot Web / Email Integration | Indirect Injection in Email Body | Automated data exfiltration via rendered Markdown image requests |
| ChatGPT Plugin Exploits (2023) | ChatGPT Third-Party Plugin API | Cross-Plugin Prompt Injection (XPIA) | User Chat Session Hijacking & PII Exfiltration |
4. Open-Source Security Tools & Repositoriesβ
- garak β Generative AI Red-Teaming & Assessment Kit (
pip install garak). - PyRIT β Microsoft Python Risk Identification Tool for AI.
- promptfoo β CLI framework for testing LLM prompts & guardrail security policies.
- NeMo Guardrails β NVIDIA's toolkit for adding programmable guardrails to conversational AI.
- Llama-Guard 3 β Open weights safety classification model by Meta.
Return to Module Overview & Index β