Unverified50% confidenceFactExact time
The input an LLM receives is a single token stream; the application layer concatenates the system prompt, user messages and retrieved content into one piece of text, and there are no field markers inside the model indicating whether a given token segment is instruction or data.
1
Sources
50%
Confidence
Long-term
Relevance
10/19/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe language model receives a single flat stream of text containing the system prompt, user messages, retrieved documents and tool return results, with no reliable way to distinguish instructions from ordinary content.75% similarUnverifiedSimilar to SQL injection, prompt injection exploits the system's confusion between 'input' and 'instruction', but the difference is that LLMs have no strict data/code separation mechanism, and all text shares the same semantic channel.74% similarVerifiedThe root cause of prompt injection lies in the fact that LLM architecture encodes system prompts, user inputs, and externally retrieved content uniformly into the same continuous token sequence, making it impossible for the model to distinguish trusted instructions from untrusted data at the semantic level.74% similarUnverifiedThe input to an LLM is tokens rather than words: text is split into tokens, and each token corresponds to an ID in a fixed vocabulary.73% similarUnverifiedLLM-based dialogue systems handle open-ended input through deep semantic understanding and can infer user intent without explicit keywords73% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1071245API
curl https://kongchang.com/api/v1/knowledge/claims/1071245MCP
get_claim(id=1071245)