The LLM Attack Surface
A classic app has a clean boundary between code and data. SQL injection happens when data crosses into the code channel; parameterised queries restore the boundary.
An LLM has no such boundary. Instructions and data arrive in the same channel — natural language — and the model decides what looks like an instruction. There is no PreparedStatement for English. That single fact generates most LLM vulnerability classes.
The pipeline is the surface:
user input → prompt template → MODEL → output → downstream consumer, with retrieved context (RAG) feeding in and tools hanging off the side.
| Surface | Risk | Analogy |
| User input | Direct prompt injection | Untrusted input |
| Retrieved context | Indirect injection | Stored XSS |
| Model output | Downstream trusts it | Output encoding failure |
| Tools | Tricked into privileged action | Confused deputy |
The one line to remember: treat all model output as untrusted input, and all model input as potentially attacker-controlled.