The nine-dimension prompt-injection study asks which attack conditions a benchmark actually exercises, rather than treating payload count as coverage. Its dimensions include source trust, fragmented instructions, conditional activation, persistent state and whether the attack preserves the user's task while changing an action or argument. Across nine…
Inspect the ClaimsCase · DiggingBeagle record
Prompt-injection benchmarks missed attack combinations despite large sample counts
A nine-dimension taxonomy found 19 of 144 pairwise property combinations absent across nine benchmarks. Generated variants exposed new failures, but the missing-coverage percentage is not an attack probability.
Public disclosure: Nov 3, 2026
Scope
Research reported in a controlled research or disclosure setting. Exact prerequisites, versions and absence of documented exploitation must be preserved.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
The cited first-party advisory or research establishes the stated mechanism only within its documented conditions. No unrelated production compromise, extended victim scope, financial harm or universal mitigation is inferred.
Assessed Nov 9, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-NINE-DIMENSION-PAIRWISE-GAPS · CLM-NINE-DIMENSION-GENERATED-VARIANTS · The Devil is in the Context: Nine Dimensions of Prompt Injection Attacks
At a glance
Aggregate benchmark attack success alone cannot establish coverage across the nine distinct contextual dimensions.
Read the implicationsTaxonomy coverage is not measured exploit probability; 40 generated cases are selected synthetic variants and attacker/defender state may co-vary.
Limits and uncertaintyFull account
The nine-dimension prompt-injection study asks which attack conditions a benchmark actually exercises, rather than treating payload count as coverage. Its dimensions include source trust, fragmented instructions, conditional activation, persistent state and whether the attack preserves the user's task while changing an action or argument.
Across nine benchmarks, 19 of 144 pairwise property combinations were absent, including 15 of 36 pairings involving less common properties. These are taxonomy-coverage counts. They do not mean that 13.2% of real attacks succeed or that every nominal combination is feasible.
Newly constructed cases changed the result
On 40 selected AgentDojo Workspace cases, the reported configuration recorded no successful attacks. Generated variants produced 17.5% attack success without an added defense. CaMeL recorded 2.5% attack success but only 27.5% legitimate utility; PromptArmor recorded 7.5% attack success with 90% utility. Choosing a defense solely by its lowest attack-success figure would discard that operational difference.
The generated variants can change surrounding task context as well as attack properties, so the experiment does not isolate one causal dimension. Its lesson is narrower: saturated performance on a selected suite does not establish coverage of conditional, persistent or task-preserving threats. Evaluation should disclose the tested conditions, unauthorized effects and authorized work completed.
Mechanism and trust boundary
- 01
Classify an indirect prompt injection jointly with the authorized user request, agent trust policy, permitted tools and retained state.
- 02
Vary visibility, fragmentation, conditional activation, persistent-state mutation, source trust and whether the attacker preserves the original task.
- 03
Evaluate whether defenses stop actual unauthorized effects and preserve legitimate task completion in each tested condition.
Claims & evidence
CLM-NINE-DIMENSION-PAIRWISE-GAPSThe study found 19 of 144 pairwise attack-property combinations absent across nine benchmarks, including 15 of 36 rare-property pairings.supported
Basis: reported finding
- supportsThe Devil is in the Context: Nine Dimensions of Prompt Injection Attacksprimary disclosure
Section V-B Coverage Analysis and nine-dimensional pairwise table
CLM-ENR231-NINE-DIM-UTILITY-TRADEOFFOn 40 generated AgentDojo variants, CaMeL recorded 2.5% attacker success and 27.5% legitimate utility, while PromptArmor recorded 7.5% attacker success and 90% legitimate utility.supported
Basis: reported finding
- supportsThe Devil is in the Context: Nine Dimensions of Prompt Injection Attacksprimary disclosure
Section VI, Security and utility results, Figure 6
CLM-NINE-DIMENSION-GENERATED-VARIANTSOn 40 selected AgentDojo Workspace instances, generated variants achieved 17.5% attack success without defense while the selected original cases recorded zero for the reported test configuration.supported
Basis: reported finding
- supportsThe Devil is in the Context: Nine Dimensions of Prompt Injection Attacksprimary disclosure
Section VI-B Taxonomy Guided Case Generation; Security and utility results
Implications
Aggregate benchmark attack success alone cannot establish coverage across the nine distinct contextual dimensions.
Controls and mitigations
- Report threat-space coverage and legitimate task completion separately; test task-preserving argument changes and persistent injections under representative harness permissions.
Unknowns and contradictions
- Taxonomy coverage is not measured exploit probability; 40 generated cases are selected synthetic variants and attacker/defender state may co-vary.
Sources and citation
Material revision history
- Nov 9, 2026 · Published version · first publication · revision 233