prompt-injection-defender

Prevent prompt injection by mapping trust zones to separate trusted developer rules from hostile context, ensuring the model never treats untrusted email or retrieved document content as executable instructions. Deterministic authorization must run outside the model to block unauthorized side effects.

Indirect prompt injection is malicious text hidden in untrusted context like retrieved documents, webpages, or tool outputs that tricks the LLM into executing unauthorized instructions. It compromises RAG assistants by hijacking their execution plan through data the system treats as safe retrieved content.

Design a red-team suite for jailbreak defense by defining concrete test payloads targeting direct, indirect, obfuscated, delimiter-escape, and multi-turn injection attempts. Each test case must specify expected safe outcomes to verify the LLM feature rejects unauthorized instructions and maintains policy.

Yes, you can use deterministic authorization to block irreversible actions by enforcing approval gates in code outside the LLM. This ensures every side effect is validated against the calling user's real permissions, preventing hijacked agents from executing unauthorized operations.

Yes, trust-zone separation works for chatbots by explicitly separating trusted system and developer rules from hostile context including conversation history. This prevents prior model turns containing injected text from being treated as trusted instructions by the LLM.