Context Engineering and Prompt Management
Prompt Injection Defense — Stack
Prompt injection defense › Stack
Technology landscape as of 2026-10-10. Knowledge cutoff May 2026.
Selection criteria
The useful question for every candidate is what remains true when the attacker has read your implementation and controls the text.
- Survivability under adaptive attack. Whether the control still holds when the untrusted content is written specifically to defeat it, rather than only against generic payloads.
- Blast-radius reduction versus detection. Whether the mechanism reduces what a successful injection can do, or only tries to notice one. The first degrades gracefully; the second fails completely when it misses.
- Ingress coverage. Whether every path is covered — tool results, retrieved documents, uploaded files, filenames, image and audio content, and data arriving through other agents.
- Placement relative to the model. Whether the control runs before admission, where it can change what the model sees, or after generation, where the effect may already have happened.
- False-positive cost. What legitimate content the control rejects, and whether the product can absorb that rate.
- Persistence awareness. Whether the control re-examines material already in the conversation record or only the current turn's additions.
- Testability. Whether the control can be exercised by a maintained adversarial suite that runs on every change.
Options
| Option | Best for | Watch out for |
|---|---|---|
| Structural separation using distinct message roles and typed content blocks | The baseline every product should have; it is what model training actually responds to | A strong prior, not a guarantee; role semantics differ per provider and change between model builds |
| Input normalisation (Unicode NFKC, stripping invisible and bidirectional control characters, flattening markup) | Removing the cheap tricks — hidden text, homoglyphs, direction overrides — before admission | Normalisation alters content the model may need verbatim, and the expensive attacks are plain readable text that survives it untouched |
| Markup and HTML sanitisers (DOMPurify, bleach, and equivalents) applied to retrieved content | Web and document sources where rendered text differs from source text | Built to stop script execution in a browser, not instruction in a model; stripping tags leaves the instruction prose intact |
| Capability reduction in the presence of untrusted content (restricted tool sets, read-only modes, scoped credentials) | The highest-value control available, because it bounds consequence rather than detecting intent | Requires a product decision about what the agent may not do, and a tool-permission layer able to vary per request |
| Quarantined sub-calls with a narrow typed return | Analysing a document or page whose content is entirely outside your control | Costs a round-trip; the guarantee disappears the moment the return type includes free text |
| Human confirmation at the action boundary | Irreversible or consequential actions, where a person is the last check | Confirmation fatigue destroys the control's value; the summary shown for approval is itself written from the compromised context |
| Injection classifiers and guard models (hosted guard endpoints, open guard models, guardrail frameworks) | Catching known payload families and raising the cost of casual attacks | Detection, not prevention; adaptive rewording defeats it, and its presence is routinely used to justify keeping privileges high |
| Adversarial test suites and agent-security benchmarks | Establishing that a defence does something, and noticing when a model change breaks it | Public suites become part of what models are tuned against; a passing score on one is not evidence against a targeted attack |