Prompt injection is not solved by filtering a few bad words
Once external content can steer a model, the real problem is not just input cleaning. Permissions, tool calls, and where output lands need a hard boundary.
Prompt injection is not solved by a keyword blacklist. When a model reads untrusted content and also has tool authority, data can masquerade as instructions. OWASP lists it as a leading LLM application risk.
Demote untrusted content
Mark web pages, email, documents, and tool results as data and separate them from system instructions. Delimiting reduces risk but is not a security boundary.
Enforce authority in the tool layer
Tools must validate identity, resource scope, and parameters with short-lived least-privilege credentials. Confirm sends, deletion, purchase, and publication, and never concatenate model output directly into SQL or shell.
Test complete attack paths
Test direct injection, indirect document attacks, obfuscation, and cross-tool exfiltration. Measure whether the side effect was prevented, not only whether a detector raised an alert.
Pre-release checks
- Untrusted text cannot raise authority
- High-risk effects require deterministic confirmation
- Tests cover retrieval and tool output
Sources
Related
Writing, extraction, long reasoning, and high-volume support do not need the same model. Cost, latency, privacy, and reliability rarely point to one name.
GPUs, operations, inference tuning, and downtime all land on the same ledger. Self-hosting only makes sense after you have done the math on volume and people.