Spotlighting
Marking where each piece of text came from so the model can tell instructions from data.
A family of techniques that annotate or transform untrusted input — wrapping it in delimiters, tagging its provenance, encoding it in a distinctive way — so the model can distinguish trusted instructions from content it should only treat as data.
The reported result was a large reduction in attack success for a small cost to the underlying task, which is a favourable trade and the reason it is widely adopted as one layer. It is a mitigation, though — it reduces the probability rather than closing the channel.
The reason it belongs in the stack is that it targets the mechanism rather than the payload: it makes provenance visible so the model has information it needs to distinguish instruction from data. That is why it composes with other defences instead of competing with them.
Layering it with a content filter
Retrieved text from an untrusted source reaches the model.
Mark it as data, and keep a permission rule on the tools that could act on it. The marking reduces how often an injection lands, and the permission rule bounds what happens when one does — which is the layered posture, and more honest than any single fix.
- paperDefending against indirect prompt injection attacks with spotlighting ↗
Marks the provenance of each input so the model can separate instructions from data. Reported cutting attack success from over 50% to under 2% in that paper’s setup — a result, not a guarantee.
- paperDefeating prompt injections by design ↗
CaMeL separates trusted control flow from untrusted data and constrains what tool calls can carry, trading some task success for provable security properties. The architectural answer to injection.
Prompt Injection
Malicious instructions hidden in content the model reads.
Indirect Prompt Injection
The hostile instructions came in through something the model read.
Guardrails
Constraints on what the system will do, enforced in code.
Grounding
Tying outputs to evidence the user can check.
Context Engineering
Deciding what goes in the window, in what order, at all.