Prompt Injection Defense
Defend against prompt injection attacks: detection techniques, input sanitization, and multi-layer defense strategies.
Last updated
After this section you can
- Recognize the four payload shapes that show up in production traffic — direct injection, indirect injection via retrieved content, roleplay jailbreaks, and encoded/obfuscated payloads — and explain at the token level why each works
- Map the 5-layer defense model onto a concrete attack and state which layers are deterministic code and which are probabilistic model controls
- Give the honest senior answer: defense-in-depth reduces but never eliminates injection risk, and the two controls that do the heaviest lifting are architectural (least-privilege tools, human-in-the-loop)
- Run a regex sanitizer against realistic payloads and explain why pattern matching is the weakest layer, false positives included
Prompt Injection Defense — 5-Layer Model
Contracts, support tickets, PDFs — all are adversarial text. Agents are uniquely vulnerable because they act on instructions.
A prompt injection is text that a model mistakes for instructions. In a chatbot that is an embarrassment; in an agent that can fire tool calls it is a remote-control channel — which is why the OWASP Top 10 for LLM Applications ranks it LLM01, first on the list. This section keeps the 5-layer defense model and adds what most write-ups skip: what the attacks look like when they arrive, and an honest accounting of what the defense buys you.
The policy side — data classification, PII, tenant isolation — was covered in Security & Privacy. This is the adversarial side: four payload shapes from real traffic, the 5-layer model mapped against them, and where the model still loses. SD-13 · Guardrails & Safety picks up the runtime enforcement layer.