ai-prompt-injection-defense

To prevent prompt injection in LLM applications, apply defense-in-depth mitigations including XML instruction/data separation, structured outputs, content filtering, least-agency tool scoping, and downstream output validation aligned with OWASP LLM01–LLM10.

Direct prompt injection manipulates model behavior via user input, indirect injection hides malicious payloads in retrieved content or tool outputs, and reflection injection exploits model outputs that become downstream actions or inputs during agent execution.

Audit agentic AI security by mapping untrusted entry points—user inputs, retrieved content, and tool outputs—to OWASP LLM01–LLM10 and ASI01–ASI10 risk categories, producing layered defense recommendations and reproducible red-team test payloads.

For red teaming LLM prompt injection vulnerabilities, the recommended toolchains are garak, PyRIT, and Promptfoo, which generate reproducible injection test payloads to validate defense-in-depth mitigations.

Yes, the defense-in-depth blueprint incorporates programmable rails such as NeMo Guardrails alongside structured outputs, defensive prompting, and tamper-evident audit logging to provide comprehensive content filtering and LLM security.

Stop indirect prompt injection from retrieved documents by implementing instruction/data separation using XML tagging, enforcing strict structured outputs, applying least-agency tool scoping, and validating downstream outputs before agent execution.