What techniques defend against prompt injection? Which ones actually work?

30-second answerSay your answer out loud first, then reveal.

No single technique fully solves prompt injection, so use defence in depth. Architectural controls are the most reliable: least-privilege tools, keeping untrusted content away from privileged actions (dual-LLM / quarantine patterns, data-flow controls), human approval for sensitive actions, and egress restrictions. Model and prompt-level measures help but are bypassable: instruction hierarchy, delimiting or marking untrusted content ("spotlighting"), injection classifiers, and output checks.

Untrusted content passes through spotlighting and an injection classifier into a quarantined LLM that returns only structured fields to a privileged agent, which also takes the trusted user request and reaches tools and egress only through a policy layer.

Effectiveness ranking (practical view)

Defence	Strength	Notes
Least privilege / no dangerous tools in contexts with untrusted data	Strong	Removes the impact even if injection succeeds
Human approval for sensitive actions	Strong	Watch for approval fatigue
Dual-LLM / quarantine, capability or data-flow tracking (CaMeL-style)	Strong but complex	Untrusted text never directly drives tool arguments
Egress controls (block markdown image exfiltration, URL allow-lists)	Strong for exfiltration	Cheap and important
Instruction hierarchy in models	Medium	Models trained to prioritise system > user > tool content
Spotlighting / delimiters / "treat as data"	Medium-weak	Reduces success rates; bypassable
Injection classifiers	Medium-weak	Useful signal; adversaries adapt

Key interview line. "I assume injection will sometimes succeed, and design so that a successful injection can't do serious damage."

PreviousYour guardrails are blocking many legitimate user requests (over-refusal). How do you fix this without weakening safety?

This is what real progress feels like.

What techniques defend against prompt injection? Which ones actually work?

Effectiveness ranking (practical view)

Related