Prompt Injection and Input Integrity

About this paper

This practitioner exam assesses deep working knowledge of prompt injection: direct and indirect vectors, retrieval and tool-calling abuse, exfiltration channels, and the architectural controls that hold when probabilistic defences fail. It is aimed at engineers and security architects building or reviewing LLM applications and agents. Candidates are expected to reason about trust boundaries, not just recognise attack names.

What it covers

• Injection vectors: direct input, indirect delivery via retrieved documents, email, web and RAG corpora
• Agent abuse: tool and function-calling manipulation, confused-deputy patterns and credential scope
• Exfiltration channels: markdown images, links and other zero-click egress from rendered output
• Probabilistic defences: delimiters, spotlighting and instruction hierarchy, and why they are not boundaries
• Output handling: model output as untrusted input to XSS, SQL and other downstream sinks
• Architecture: human-in-the-loop placement, allowlisting, and injection propagation across multi-agent systems

How it is marked

• Questions and answer options are shuffled for every sitting.
• Multi-answer questions are marked as a set: you need all of the correct options and none of the wrong ones. There is no partial credit.
• You need 70% to pass.
• You can revisit and change any answer until you submit.
• Afterwards you see every question, the answer you gave, whether it was right, and the reasoning behind it. The answer key itself is never printed, so the paper stays worth sitting.
• You can re-sit the paper, but not immediately: there is a short wait between attempts.