Context
Bağlam
D3
Context is information made available with a model request that can condition how the model produces an output.
Review status: 2026-11-26
Technical explanation
Depending on the application, context can include instructions and documents retrieved at runtime for the current request.
Conceptual boundaries
Context is request-time input rather than further model training, and external material can remain untrusted.
Provider-neutral example
Before answering a policy question, an application can place the user’s question and selected policy excerpts in the same request context.
Limitations
External context can contain attacker-controlled instructions, so it must not be treated as trusted merely because it was retrieved for the request.
Related concepts
Atomic claims and evidence
1.1NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations
- Source
- NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations
- Source role
- Authoritative source
- Exact locator
- Section 3.1.1 printed p. 39: Runtime data ingestion from third-party sources
- Supported claim
- In RAG and related applications, context can be crafted at runtime in a query-dependent way and populated from external documents or web pages.
- Last verification
- Review due
- Scope limitation
- This describes a runtime application pattern and does not define all possible forms of model context.
2.1NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations
- Source
- NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations
- Source role
- Authoritative source
- Exact locator
- Section 3.1.1 printed p. 39: indirect prompt injection and external sources ingested into context
- Supported claim
- External information ingested into model context can be modified by an attacker and used for indirect prompt injection.
- Last verification
- Review due
- Scope limitation
- This is a security risk statement, not proof that a particular context source is malicious or inaccurate.