The Single-Channel Problem

The root vulnerability: one token stream with no type system separating instructions from data — and why training alone cannot close it.

Content last verified 2026-09.

Lessons

1. One Token Stream
2. Why Training Can’t Fix It
3. The Attack Surface Map

Sources

• Wallace et al. (2024) — The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions
• Greshake et al. (2023) — Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
• Zou et al. (2023) — Universal and Transferable Adversarial Attacks on Aligned Language Models
• OWASP Top 10 for LLM Applications (2025)