Part II · The context window

The context window is the security boundary that has no equivalent in ordinary software. Everything the model reasons over arrives in one flat span of tokens: your instructions, the user’s question, and whatever a retrieved document happens to say. Nothing in the format marks which is which.

Each part of this book splits the same three ways: how it works, how it breaks, and how you hold it. The attack and the control for one layer sit together, because that is how you actually meet them.

How it works

II.1 How LLMs work - tokens, attention, context How a large language model actually works - tokens, embeddings, attention, the context window, and temperature - and why instructions and data share one channel. concept · 4 min read

How it breaks

II.2 Prompt injection & the LLM attack surface The OWASP Top 10 for LLM Applications, prompt injection, jailbreaks and backdoors, the lethal trifecta, and unbounded consumption. attack · 9 min read II.3 Jailbreaks & guardrail bypasses A red-team field guide to jailbreak and guardrail-bypass families, organized by mechanism, each paired with research and defense. attack · 12 min read II.4 Multimodal - what a text filter cannot see Image-based prompt injection, adversarial perturbations through the vision stack, and why text-only defenses lag. attack · 4 min read

How you hold it

II.5 Guardrails - what holds, and how to prove it Defense-in-depth along the request lifecycle, guardrails by type, the client-facing mitigation matrix, red-teaming your own defenses, and MLSecOps. defense · 16 min read