What is LLM prompt injection?

Short answer

LLM prompt injection is an attack that steers the model into unintended behavior by placing expressions that override the model's instructions in the input sent to an application that uses a large language model (LLM): for example, bypassing security rules, exposing the system instructions or confidential data, or misusing the tools connected to the model. It arises because the model cannot strictly separate data from instructions in the input (OWASP LLM01, CWE-1427); it can be direct, with text the user writes, or indirect, with text hidden in the documents and web content the model reads. In the TR7 WAF, the built-in Signature & Rule Library looks for known patterns in the incoming request with its LLM Prompt Injection category (16 rules) and labels the findings with the MITRE ATLAS technique; it does not inspect the model's response or the content the model reads later.

Where It Is Used in TR7

Where	Field / label	What for
Configuration Menu → WAF → Signature & Rule Library; the OWASP Rules screen of the vService	The Signature Category column (hidden by default); Filter → Signature Categories → LLM Prompt Injection; Protected Target Types → Ai Llm Service	Listing the rules in the category; changing their state or score
The same screens → Add	Custom rule	Adding rules for expressions the built-in patterns do not cover (e.g. languages other than English)
WAF Event Logs and Global WAF Event Log	The Category column (hidden by default), the Category and MITRE ATT&CK tabs on the filter strip, the Category row in the record preview	Seeing that the request was caught by a signature in this category
WAF Dashboard	The Detected Attacks by Category panel	The density of the detections in the category over time

• Which patterns the rules look for, which request fields they work in, their relation to the protection level, and trying them in the Monitor state against false positives: Can it catch prompt injection attacks against my LLM / AI services?
• The rules of the category are not mapped to an item of the OWASP Top 10 Web or API lists; for this reason, they do not appear in the OWASP breakdowns.

Common Misconceptions

• "Prompt injection affects only chatbots." Every application that passes user input or external content to an LLM (summarization, search, agent, e-mail assistant) can be affected.
• "WAF signatures catch all attempts." Signatures catch known patterns; the variation in natural language is very wide. On the application side, limiting the model's permissions and inspecting its output are also required.
• "Indirect prompt injection also arrives inside the request." The hidden instruction in a document or web page the model reads later may not be in the request that passes through TR7; WAF scans only the incoming request.

How it is done in the documentation

• Signature & Rule Library · Signature Categories
• Signature & Rule Library · Protected Target Types
• Signature & Rule Library · Rule Add Form

Related questions

• Can it catch prompt injection attacks against my LLM / AI services?
• What is MITRE ATT&CK; what do the MITRE ATT&CK and MITRE Post-Exploit fields in TR7 show?
• Which attack categories do the signatures cover?