Prompt Injection Defense
Why injection works (instructions and data share one stream), the four ways it arrives, why text filters only lower the odds, and the architecture that bounds the damage: the Rule of Two, taint, planner and reader splits, and adaptive testing.
Last updated
After this section you can
- Explain why text filters lower the odds and cannot draw the boundary
- Count the legs of an agent session and cut one of them
- Design a code gate that decides an action from its arguments and taint
14
Prompt Injection Defense
Why text filters only lower the odds, and what in the architecture bounds a fooled model.
Key idea
You cannot filter injection away: instructions and data share one token stream. Decide in code what a fooled model may do, and let that code decide without reading the text it is defending against.
A fooled model is survivable when code checks its action
Blue input, amber model, red action, green code. Pans sideways on a phone.