You just survived 9 attack scenarios. Here's what stuck.
Quick recap
9 scenarios, one root cause. Every single attack worked because the model treated attacker-controlled content like a legitimate instruction. The channel changed. The trick changed. The root cause never did.
The attacks range from simple to wild. Typed inputs, poisoned RAG docs, encoded payloads, images with hidden text, adversarial suffixes — attackers get creative.
You can't patch the root cause. It's how language models work. Defense means limiting the damage when it happens — not pretending it won't.
Last section is all about that. 7 mitigations. Practical, OWASP-backed, mapped to the attacks you just saw.