AID-H-016: Instruction Hierarchy & Prompt Injection Hardening
Harden instruction-following systems at two independently deployable layers: application-side prompt structure that separates trusted instructions from untrusted data, and model-weight-level alignment training that teaches the model to preserve that hierarchy under injection attempts.
Scope boundary
Owns instruction-precedence and instruction-versus-data hardening in prompt construction and model training. Neither child grants tool authority or guarantees prompt-injection immunity; runtime action authorization remains in AID-H-018.
AID-H-018: AID-H-016 reduces the chance that untrusted content overrides instruction hierarchy; AID-H-018 independently authorizes and constrains tool actions and side effects. Instruction robustness is defense-in-depth and cannot grant runtime authority.
Sub-techniques
Threat mappings
MITRE ATLAS
- AML.T0051 LLM Prompt Injection
- AML.T0051.000 LLM Prompt Injection: Direct
- AML.T0051.001 LLM Prompt Injection: Indirect
- AML.T0051.002 LLM Prompt Injection: Triggered
- AML.T0054 LLM Jailbreak
- AML.T0065 LLM Prompt Crafting
- AML.T0068 LLM Prompt Obfuscation
- AML.T0110 AI Agent Tool Poisoning
- AML.T0110.002 AI Agent Tool Poisoning: Runtime Response
- AML.T0130 AI Agent Response Biasing
- AML.T0131 Crafted AI Assistant Links
MAESTRO
- Input Validation Attacks (L3)
- Agent Goal Manipulation (L7)
OWASP LLM Top 10 2026
- LLM01:2026 Prompt Injection
OWASP ML Top 10 2023
- N/A
OWASP Top 10 for Agentic Applications 2026
- ASI01:2026 Agent Goal Hijack
NIST Adversarial Machine Learning 2025
- NISTAML.015 Indirect Prompt Injection
- NISTAML.018 Prompt Injection
Cisco Integrated AI Security and Safety Framework
- AITech-1.1 Direct Prompt Injection and Jailbreak (Prompt-based Manipulation)
- AITech-1.2 Indirect Prompt Injection
- AITech-4.2 Context Boundary Attacks
- AITech-4.3 Protocol Manipulation
- AITech-5.2 Configuration Persistence
- AISubtech-1.1.1 Instruction Manipulation
- AISubtech-1.1.4 Token Exploitation
- AISubtech-4.3.1 Schema Inconsistencies
- AISubtech-5.2.1 Agent Profile Tampering
Google Secure AI Framework 2.0 - Risks
- PIJ: Prompt Injection
Databricks AI Security Framework 3.0
- Model Serving - Inference requests 9.1: Prompt inject
- Model Serving - Inference requests 9.12: LLM Jailbreak
- Agents - Core 13.6: Intent Breaking & Goal Manipulation