A Systematic Review of Prompt Injection Attacks on Large Language Models: Trends, Taxonomy, Evaluation, Defenses, and Opportunities
J Duarte, Guilherme Dieguez Candido, José Ricardo A. De Britto Filho, João Souza Neto, Elena J. da Costa, João Paulo J. Da Costa, Laerte Peotta de Melo · IEEE Access · 2026
Large Language Models (LLMs) are increasingly integrated into various infrastructure and interactive applications. However, their inherent linguistic flexibility introduces security vulnerabilities, particularly through Prompt Injection (PI) attacks. This systematic review provides a comprehensive synthesis of the evolving landscape of PI attacks, including their development trends, classification schemes, evaluation methodologies, defense strategies, and areas for future research. We analyze the evolution of attacks from basic natural language overrides to complex multi-turn manipulations, indirect injections using structured formats such as JSON and XML, and tool-assisted exploits involving automated prompt generation and multi-modal inputs like images. PI attacks are categorized by the level of manipulation, including character, word, sentence, and semantic levels, and by adversarial intent, such as prompt leaking and harmful content generation. The study analyzes these techniques within different LLM architectures and application contexts, including machine translation and Chain of Thought reasoning. It also reviews common evaluation benchmarks, datasets, and metrics. Mitigation strategies examined include automated red teaming frameworks, input validation, content filtering, and alignment through training. It differentiates itself from previous works by conducting a systematic review specifically focused on immediate injection, organizing its attacks, defenses and research gaps. Finally, this review identifies major research challenges and suggests critical directions for improving LLM safety and robustness.