ai-prompt-injection-defense

Prevent prompt injection by isolating user input inside XML delimiter tags and instructing the model to treat tag contents as data, not instructions. Combine this with input validation, output validation, and structural separation since no single layer catches all attacks.

Direct injection is when a user types adversarial text like 'ignore previous instructions' into the prompt. Indirect injection hides payloads in external data the LLM reads, such as poisoned PDFs or hidden text on websites the model fetches.

Use a small fast model like Claude 3 Haiku or GPT-4o-mini as a firewall that classifies incoming text as SAFE or MALICIOUS before it reaches the main agent. Reject requests flagged as malicious with an HTTP 400 error.

Read-only database access limits the blast radius if the LLM is compromised through injection. A database user with only SELECT permissions prevents an attacker from executing destructive statements like DROP TABLE through generated SQL.

No, output filtering alone is insufficient because injections can manipulate behavior without producing detectable output patterns. Defense-in-depth requires input validation, structural isolation with delimiters, least-privilege tools, and output sanitization together.