Prompt Injection Defense

Prompt injection defense aims to stop untrusted text, images, or other inputs from overriding a user’s instructions, especially in agents that browse, retrieve documents, or use tools. Approaches include detecting and sanitizing suspicious content, training models to respect instruction hierarchies, and enforcing permissions at runtime through provenance tracking, privilege separation, or tool-call authorization. Evaluation increasingly uses adaptive attacks and realistic, multi-step settings such as web agents, retrieval-augmented generation, and tool workflows, rather than relying only on fixed prompts. The main tension is reducing harmful actions without blocking legitimate information or useful tasks; defenses that work on known attacks may fail on new surfaces, longer contexts, or adaptive adversaries.