The anatomy framework
Delivery surface × propagation × encoding: the tagging scheme used site-wide.
Before you learn a single attack technique, you need a way to file them. OWASP gives you one: any prompt injection decomposes along three independent axes. Learn the axes and every technique in this track slots into a place you already understand, which lasts far longer than a memorised list of named tricks.
Three axes
The scheme comes straight from the LLM01:2026 description. Every injection can be characterised by how it reaches the model, how it spreads, and how it is represented.
| Axis | Values | The question it answers |
|---|---|---|
| Delivery surface | direct input · retrieved content · tool output · tool connection channel · persistent memory | How does the instruction reach the context window? |
| Propagation | single-shot · multi-step kill chain · cross-session (memory/RAG) · self-replicating | How far does it spread in time and across boundaries? |
| Encoding | plain text · base64/obfuscation · invisible Unicode · multimodal/steganographic · low-resource language | How is the instruction represented in tokens or pixels? |
OWASP also says what the scheme is for:
Decomposing a scenario along these axes is a useful threat-modeling step before selecting which mitigations apply.
Tag an attack and the tags point at the defences. A retrieved-content delivery says look at provenance and RAG authorization. Cross-session propagation says look at memory-write controls. Invisible-Unicode encoding says look at normalization at the ingest boundary. Three lookups instead of one open question.
Why decompose before defending
The scheme prevents defending against a technique instead of a class. A team reads about Crescendo, adds a Crescendo detector, and feels safer until the next multi-turn variant the detector has never seen. Tagging first stops that. Crescendo is direct · multi-step · plain text, and defending the class means you are not chasing names.
Practise it
Tag these before reading the answers. Every scenario is real, from the OWASP LLM01 examples or a documented incident, so the tags you build here are the tags used throughout the course.
Anatomy tagger
1/6A user asks an assistant to summarise a web page. Hidden in the page source is an instruction that makes the model emit a Markdown image whose URL carries the conversation to an attacker domain.
Delivery surface
Propagation
Encoding
How the axes reappear
Each remaining module in this track lives at a point in this space:
| Module | Where it sits |
|---|---|
| 2.3 Direct primitives | direct · single-shot · plain text |
| 2.4 Encoding | any delivery · any propagation · non-plain encodings |
| 2.6 Multi-turn | direct · multi-step · plain text |
| 2.8 Multimodal | retrieved · single-shot · multimodal/steganographic |
| Track 03 (indirect) | retrieved / tool-channel / memory · often cross-session or multi-step |
Sources
- T1OWASP Top 10 for LLM Applications 2026 · LLM01:2026 description (the delivery/propagation/encoding axes and the instruction to decompose before selecting mitigations); Scenarios #2, #4, #5, #6, #9 for the tagger cases
- T1Clusmann et al. (2025) · Prompt injection attacks on vision language models in oncology, Nature Communications (sub-visual injection against Claude-3 Opus, Claude-3.5 Sonnet, Reka Core and GPT-4o; N=594)