Prompt injection

Prompt injection

In that relatively simple CV analysis case, it shouldn't be too hard to draw a line between "code" and data, should it?

Maybe. But I think this is a hard problem in general.

First you would need to define what "code" and what "data" is in the context of LLM inputs. If you instruct an LLM to read an API documentation you surely want it to change behavior and adhere to what it read there. If you want the LLM to call the Frobbler, then surely it shall call the function frobble() as documented in this API section. But what if the Frobbler section said to call rm -rf $HOME or something similar but less obvious instead?

This has more in common with social engineering than "code vs. data" or typical data injection.