Reduce prompt injection risk by treating external text as untrusted data and enforcing permissions outside the model. Prompts and detectors can support these controls, but cannot guarantee that an application will resist every attack.
Separate instructions from retrieved content
A web page, uploaded document, email, or tool response can contain instructions aimed at the model. Keep its origin visible and do not grant it the authority of system instructions. Delimiters help express the boundary, while application controls enforce what actions are possible.
Constrain actions at the tool boundary
- Use the authenticated user and server-side authorization to decide which records a tool can access.
- Validate tool arguments against an allowlist of operations and expected input shapes.
- Restrict network destinations and secrets available to the execution environment.
- Require the appropriate human confirmation before consequential external actions.
Test indirect attacks
Place a harmless test instruction in a retrieved document asking the assistant to reveal a test secret or take an unauthorized action. The test should verify the application denies the action, not merely that the assistant says it is safe. Repeat through document metadata, tool errors, and encoded content your pipeline actually parses.
Record both the attempt and the outcome
Distinguish an attack-like string from a successful boundary failure. Record the source, tool attempt, authorization result, and sanitized evidence. Feed verified failures into regression cases. A detector flag alone does not prove that an attack succeeded.
References and further reading
Maintained by DriftRail. AI assisted the October 2026 content and template revision. Examples are illustrative; they are not measured product benchmarks. Suggest a correction.