- 01Detection-based defenses (input filters, prompt firewalls, instruction-hierarchy fine-tunes) cap at 60–80% efficacy and degrade against novel attacks. Architectural defenses do not.
- 02The pattern that holds: untrusted text reaches a view-only model only; a separate planner with tool access sees only schema-validated structured output.
- 03The blast radius of any successful injection collapses to whatever the structured-summary schema permits — no free-form attacker text ever reaches a tool-enabled model.
- 04Defense in depth still applies: tool-use logging, scoped capability tokens, output validation that fails closed, and human approval for irreversible actions.
Prompt injection cannot be reliably detected. After two years of input-filter research, instruction-hierarchy fine-tunes, and prompt-firewall vendors, the consensus from production teams is that detection is a soft mitigation. Architectural defenses — isolation between trusted and untrusted contexts — are what hold.
The architectural pattern
- 01Treat all retrieved or user-supplied text as untrusted input
- 02Run that text through a 'view-only' model that cannot call tools
- 03Have the view-only model produce a structured summary
- 04A separate, tool-using planner model receives only the structured summary
- 05Tools have strict, scoped permissions enforced outside the model
Why this works
An attacker who succeeds in injecting instructions into the view-only model cannot reach tools. The planner sees only the structured summary, which is a constrained interface — no free-form attacker text reaches the model with tool access.
It is not perfect: the structured summary itself can be subtly poisoned. But the blast radius is bounded by the schema of the summary, not by the creativity of the attacker.
What we still recommend in addition
Tool-use logging and replay, output validation that fails closed, rate limits per tool per user, and human approval for any irreversible action. Defense in depth applies to LLM systems exactly as it does to traditional ones.