“Control-data plane confusion” is the phrase NVIDIA’s post Securing LLM Systems Against Prompt Injection uses for why prompt injection resists the usual defences. Contrary to standard security best practices, that post argues, the control and data planes are not separable when working with LLMs: a single prompt contains both control and data, and prompt injection exploits that lack of separation to insert control elements where data is expected. On this account the vulnerability is not a defect in any particular application but something the post calls inherent in current LLMs, which is why it treats prompt injection as something to design around rather than to patch. The phrase appears once, in that post’s own conclusion, rather than as a term it presents as established.
Usage
The phrase is used to explain a consequence rather than to name a technique. Because an attacker who can get text into the prompt can reliably steer what comes out, the post’s stated conclusion is that every LLM production must be treated as potentially malicious and under the control of any entity able to inject text into the input — inspected and sanitized before anything downstream parses it. That downstream is where the damage lands: the post’s three worked cases are chains that take the model’s output and build a call to an interpreter, an HTTP endpoint or a database from it, so control over the output becomes control over the service.
The defensive posture the NVIDIA AI Red Team recommends there follows from treating the output as untrusted rather than from trying to clean the input. Calls to external services must be strictly parameterized and made in a least-privileged context, with the lowest privilege of any entity that contributed to the current prompt applied to each subsequent call; plug-in templates should be parameterized wherever possible; and inputs should be examined specifically for attempts to exploit this confusion. Where it can be avoided, the post advises not connecting models to external resources at all, and singles out multistep chains that call several services as needing rigorous review.
Related Terms
Prompt injection, Indirect Prompt Injection, Dual LLM Pattern, Guardrails, LangChain, Securing LLM Systems Against Prompt Injection