A city attorney trains staff that prompt injection is an AI-specific input threat where untrusted text tries to manipulate model instructions—not merely classic web XSS. What understanding should staff take away?
Select an answer to reveal the explanation.
Short Explanation
XSS messes with browsers; prompt injection messes with the model’s sense of who is boss. Staff should treat it as its own AI input-threat class—adversarial text that hijacks instructions—not as “just SQL with friendlier words.”
Full Explanation
Prompt injection is a distinct AI-era attack class: untrusted natural-language or embedded text tries to manipulate the model’s instruction-following so attacker goals compete with system policy. City attorney training that contrasts this with classic web XSS is correct at the recognition level—related in spirit to “untrusted input,” but different in mechanism and mitigations. Staff should treat adversarial instructions to the model as their own threat category in municipal AI risk programs.
Claiming prompt injection is identical to SQL injection and needs only prepared statements fails by concept: prepared statements protect structured queries, not free-form LLM instruction channels. Claiming it only happens when GPUs overheat fails because thermal events are hardware conditions, not input threats. Claiming a larger context window solves it forever fails because more context can even increase the surface for injected text rather than eliminate the class.
Exam caveat: Mitigations include privileged system prompts, input/output filtering, least-privilege tools, human approval, and separating untrusted retrieved content from commands—not a single database control. XSS defenses remain necessary for web apps that host chat UIs, but they do not replace LLM-specific injection defenses. Exam answers that collapse prompt injection into SQLi or hardware myths are distractors.
Operational check: Add “prompt injection” as a named risk with direct/indirect examples in the city AI register, map owners and controls, and tabletop a scenario where untrusted ticket text tries to override the assistant’s legal-advice boundaries.