LLMs, GenAI, RAG, agents, evaluation · insight-0532

Separate instructions from pasted data with clear delimiters, but do not call it security

Situation
A prompt mixes instructions with a pasted customer email, and the model sometimes follows sentences inside the email as if they were instructions.
Action
Wrap each data block in labelled delimiters or tags, refer to them by name in the instructions, and handle hostile content with the controls taught on Days 47 and 53 (least-privilege tools, output validation, human approval).
Reason
Clear structure helps the model tell instructions from material, but text-level separation cannot guarantee that injected instructions are ignored.
Boundary
Any prompt that includes user-supplied or retrieved text.

Symptom or risk

Outputs drift with whatever the data says, and the team assumes delimiters will also stop deliberate attacks.

Prompts with no external content need little structure.

Tags add tokens and must be kept consistent across prompt versions.

Shipping a tool-using feature whose only defence is a delimiter.

Greshake et al. showed that instructions embedded in retrieved content can steer LLM-integrated applications (indirect prompt injection).
Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection