Claim◆Article
Almost every LLM vulnerability traces to a single property: a language model receives instructions and data as one concatenated sequence of tokens with no marker separating commands from information, which is the root cause of the entire threat model.
The article argues the root cause of virtually all LLM vulnerabilities is that instructions and data arrive as one combined token sequence with no structural boundary between them, unlike parameterized queries in traditional software. ✦ AI generated
Article author (GLM pipeline) · ByteByteGo Newsletter · 2026-08-03 · original ↗
Almost every LLM vulnerability traces to one property. A language model receives instructions and data as a single sequence of tokens, and that sequence contains no marker separating commands from information. Traditional software keeps the two apart. For example, a parameterized database query holds the command in one position and the user's input in another. This means that the text typed into a name field stays text even if it spells out a SQL statement, because the structure of the query enforces the separation. However, an LLM context has one position for everything. The system prompt defining the assistant's role, the user's message, a document retrieved from a database, and the output returned by a called tool all arrive concatenated in the same sequence. Any portion of that sequence can affect the generated output as if it were an instruction.
Read full article ↗excerpt · fair-use quotation
- ·Instructions and data arrive as one combined token sequence
- ·No marker separates commands from information
- ·This single property drives the entire threat model
- ·Parameterized queries keep command and input separate
- ·User input stays text even if it spells SQL
- ·LLM context has one position for everything
Around this claim
Mechanism · 3
Prompt injection reaches a model by two routes — a direct route (hostile instructions typed into the chat box) and an indirect route (instructions embedded in content the model retrieves during a legitimate task) — and the EchoLeak incident demonstrates the indirect route passing through a dedicated cross-prompt-injection classifier.Article author (GLM pipeline) · ByteByteGo Newsletter · conf 90%Attacks aimed at a model's interior — model theft, training-data extraction, and poisoning — are bounded and largely mitigated for most developers, ranking low for initial effort compared to risks around external actions.Article author (GLM pipeline) · ByteByteGo Newsletter · conf 70%Supply chain attacks, ranging from a compromised model to a poisoned vector store, bypass runtime defenses because the threat is present before input validation runs, yet provenance is the surface most directly controllable and the attack source spanning all stages.Article author (GLM pipeline) · ByteByteGo Newsletter · conf 70%