12 attack patterns we see in production, the defenses that actually work, and the eval set we run on every prompt change.
Prompt injection is not a theoretical attack anymore. We see it weekly in production traffic. Below: the 12 attack patterns we see most often, the defenses that actually work, and the eval set we run on every prompt change. Why this is harder than it looks The most common failure mode with security for prompt-injection businesses is treating the problem as a model selection problem. The hard parts are the data pipeline feeding it, the eval that catches regressions, and the human ownership layer that keeps the system honest after the implementer leaves the building.
The hard parts are the data pipeline feeding it, the eval that catches regressions, and the human ownership layer that keeps the system honest after the implementer leaves the building. We have shipped this category of system enough times to recognize a few patterns. The teams that win allocate roughly 20 percent of project time to the model and prompts, 40 percent to data and integrations, 25 percent to evals and observability, and 15 percent to change management. The teams that lose flip those numbers, spend 70 percent on prompts, and end up with a great demo that nobody trusts. The good news is that none of this is novel engineering.
12 attack patterns we see in production, the defenses that actually work, and the eval set we run on every prompt change. It is filed under AI Infrastructure because that is where operators looking for this problem actually start, and it is written from production work rather than from a content calendar.