A resident pastes instructions telling the 311 bot to ignore prior rules and reveal internal routing notes. Analysts should classify this evidence as which attack?

When a resident pastes instructions telling the 311 bot to ignore prior rules and reveal internal routing notes, analysts should classify the evidence as prompt injection: adversarial natural-language content intended to override system or developer instructions and exfiltrate protected context. Prompt injection abuses the model's instruction-following behavior rather than classic memory corruption; success looks like policy bypass, secret leakage, or tool misuse triggered by text in the user channel (or in retrieved documents). Correct classification matters in a municipal SOC so playbooks apply input filtering, prompt firewalls, and disclosure response instead of unrelated desktop or database procedures.

Training data poisoning embedding malicious routing behavior during development fails as a classification here because the evidence described is text pasted into the bot's own input channel attempting to override its instructions, not a malicious pattern injected into the model's training data during development. Model hallucination generating inaccurate routing notes from internal errors fails because the artifact in evidence is an instruction-override payload aimed at changing the assistant's behavior, not an internal error causing the model to fabricate routing notes. Retrieval grounding error exposing internal notes through misconfigured search fails because the artifact is natural-language instruction override against an LLM assistant, not a misconfigured search retrieving internal notes.

Exam caveat: Prompt injection may be direct (user message) or indirect (poisoned documents retrieved into context). Do not require a successful breach to classify the attempt—the pasted override language is already evidence of the attack class. Distinguish prompt injection from jailbreaking: overlapping tactics, but this stem emphasizes override-and-exfiltrate instructions against the assistant's rules.

Operational check: Tag the 311 event as prompt injection in the case; preserve the prompt evidence; check whether routing notes leaked; enable/strengthen prompt firewall and output filters; and update 311 AI detections for "ignore previous instructions" and similar patterns.