Prompt Injection Detection — Patterns

Scan where the text enters, in the form it arrived

Problem. By the time content reaches the assembled prompt it has been extracted, chunked, truncated, translated, summarised, and concatenated with other sources. Each of those transformations removes evidence, and the last one removes the boundary that said which bytes came from where.

Approach. Attach scanning to admission: the moment a document is ingested, a page is fetched, or a tool returns, score it in its original encoding, before extraction has flattened it, and carry the verdict forward as an attribute of that span. Downstream stages read the attribute rather than re-deriving it, and a stage that produces derived text copies the verdict onto the derivative.

Trade-off. Scanning everything on admission costs far more than scanning what a request actually uses, and most of what is scanned is never retrieved. The verdict also ages: a document scanned last year was scored by a detector that did not know this year's families, so admission scanning needs a rescan policy that corpus owners rarely budget for.

A response ladder, not a switch

Problem. Treating every finding as grounds for refusal is unusable: the detector is wrong far more often than it is right at realistic base rates, and refusing costs a legitimate user their answer. Treating findings as advisory means nothing changes when one is correct.

Approach. Define several responses of increasing severity and bind them to confidence and to what the run can currently do: excise the span and continue, drop the source and tell the user the answer is partial, withdraw tools with external effects for the remainder of the turn, require confirmation for anything consequential, abandon the run. Low-confidence findings take the cheap rungs. The expensive rungs are reserved for findings that coincide with the run holding real capability, because a flagged span in a read-only summarisation is not the same event as a flagged span in a run with send and write tools attached.

Trade-off. A ladder is more machinery and more configuration than a boolean, and its rungs need their own testing. Partial answers also create a quiet correctness problem: the user receives something plausible that is missing the part the system removed, and unless the omission is stated clearly they will act on an incomplete picture.

Adjudicate out of band, return only a label

Problem. Asking a model whether its own context contains an injection puts the judgement inside the thing being judged. Even when the judgement is separated, a verdict returned as free text is a channel the scanned content can write into, and downstream code that reads that text is now taking instructions from the attacker at one remove.

Approach. Run the adjudication in an isolated call that receives the span and nothing else: no tools, no system instructions worth subverting, no conversation history. Constrain the output to a closed set of labels plus a numeric score and a span offset, and discard anything else the model produces. Nothing in that call shares state with the request it is protecting.

Trade-off. A judge with no surrounding context cannot tell a hostile instruction from a document that legitimately quotes one, which is a large fraction of the false positives this design produces. Isolation also costs a second call with its own latency and its own availability, on a path that was already slow.

Account for findings by source, not by request

Problem. A single poisoned document retrieved by thousands of requests produces thousands of low-confidence findings spread thinly across the traffic. Every per-request dashboard shows a flat, unremarkable rate, and the one actionable fact — that one document is responsible — is invisible.

Approach. Key every finding to the origin of the span: the document identifier, the repository, the domain, the integration, the sending address. Aggregate on that key, alert on concentration rather than on volume, and make the artifact of detection a report about a source that someone can be asked to clean. Quarantine at the source level, which removes the finding from every future request at once.

Trade-off. Source attribution requires provenance to survive the whole pipeline, which is a standing cost on every ingestion path and the first thing a refactor drops. Quarantining a source is also a far larger action than excising a span — it removes a supplier's entire document set from a corpus — and needs an owner and an appeal path before it can be automated.