You know how a locksmith doesn't just test one kind of pick? They categorize lock attacks by entry angle, tool type, force profile, and target mechanism — because a bump key and a rake work on completely different principles even though both open the same lock. This paper does that for prompt injection: it stops treating all injections as one thing and maps nine independent dimensions along which they vary. The committed claim: prompt injection is not a single attack type but a nine-dimensional space, and most existing defenses are evaluated against a thin slice of it. The authors identify dimensions spanning the injected instruction itself (what it says, how it's phrased), its relationship to the user's legitimate task (aligned, orthogonal, adversarial), and how it manifests in the target system (direct input, indirect via retrieved data, multi-turn persistence). Crucially, the same instruction can be legitimate in one context and an injection in another — intent and system policy are load-bearing variables, not decorative metadata. The ladder here is structural, not numeric. Prior prompt injection work — from Greshake et al.'s indirect injection taxonomy to the BIPIA and TensorTrust benchmarks — has treated injection as a binary classification problem: is this input malicious or not? The authors audit nine existing benchmarks against their taxonomy and find that most cover only a narrow corridor of the attack space. The union of all nine benchmarks still leaves 13% of pairwise dimension-category combinations completely untested. That's not a gap at the edges — the uncovered regions cluster in exactly the less-common but real-world-relevant categories. Architecturally, this is a classification and annotation framework, not a detection model. The taxonomy is designed to be applied manually or via LLM-based automated annotation. The authors demonstrate both: they hand-label six real-world CVE-style prompt injection vulnerabilities to show dimensional diversity, then use GPT-4-level models to auto-annotate benchmark datasets and generate targeted new test cases to fill coverage gaps. The method leans on LLM reasoning for annotation and generation, not on any novel detection architecture. Integrity is mixed. On the positive side, the six real-world vulnerabilities are drawn from publicly reported incidents, not synthetic examples — which grounds the taxonomy in actual exploitation patterns. The benchmark audit is systematic: every sample from nine benchmarks is annotated across all nine dimensions. On the weaker side, the automated annotation quality depends on the annotating LLM's own robustness to prompt injection (a circularity the authors acknowledge but don't resolve), and the taxonomy itself is not validated via inter-annotator agreement with independent security researchers. The gap analysis (13% untested) is descriptive, not predictive — we don't know if those gaps correspond to practical attack surfaces or theoretical corners. The milestone that matters: adoption. A taxonomy is a tool, and the paper's value scales with how many benchmark authors, defense papers, and system operators actually use these nine dimensions to characterize their coverage. The concrete next number is benchmark coverage: can the community close that 13% gap within 2-3 years, and does closing it actually change detection rates? The authors provide generation tools to fill gaps, but no evidence yet that doing so improves any defense's performance. The obvious experiment the authors didn't run: testing whether defense performance actually changes when benchmarks are rebalanced across the taxonomy. They show the coverage gaps exist and demonstrate they can generate test cases to fill them, but they stop short of retraining or re-evaluating any defense on a rebalanced benchmark. My read: this is a (c) — they're saving it for the next paper. The taxonomy paper establishes the framework; the defense-evaluation paper is the sequel. Reasonable strategy, but it means the current contribution is structural, not empirical in the defense-improvement sense.
