---
title: Research: PIAtlas maps prompt injection by how the injected instruction subverts the model, and finds agent benchmarks test only part of the attack space | ctxsec
url: https://ctxsec.com/items/arxiv-piatlas-prompt-injection-sok
description: ""
status: "research (arXiv preprint, not peer reviewed)"
published: 2026-10-19
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/arxiv-piatlas-prompt-injection-sok.md)

research (arXiv preprint, not peer reviewed)

2026-10-19

### Research: PIAtlas maps prompt injection by how the injected instruction subverts the model, and finds agent benchmarks test only part of the attack space

An Oct 18 arXiv Systematization of Knowledge by Stavros Damianakis and Konstantinos Psounis argues that the 20-plus public prompt-injection datasets describe attacks in incompatible ways, usually by delivery vector, attacker goal or generation method. PIAtlas instead sorts attacks by _how the injected instruction is built to subvert the model_. It has six root classes, one per subversion mechanism, derived from how LLMs are trained, prompted and swayed by human-like framing, and each class branches into techniques and sub-techniques. The authors also release PICorpus, which they describe as the largest license-clean collection of public prompt-injection datasets, and map thousands of its records to the taxonomy under a human-verified protocol. Their findings: real attacks usually combine several techniques drawn from only a few mechanisms; widely used agent benchmarks cover only part of the attack space; and adaptive attackers favor mechanisms that curated benchmarks underrepresent. Takeaway for teams red-teaming agents or MCP-connected tools: a good score on one public injection benchmark doesn't mean broad coverage. Check which mechanism classes your test set actually exercises. Code, data and an interactive taxonomy are public.

Sources: [arXiv 2610.24999: SoK: PIAtlas](https://arxiv.org/abs/2610.24999) · [PIAtlas code + data (GitHub)](https://github.com/stevendamianakis/piatlas)