Five ways to stop an attack, and where each one gives way.
| Layer | Verdict | Fails on |
|---|---|---|
| System prompt | Guides model behaviour | A hidden instruction competes with every instruction that comes after it. |
| Input filter | Fails on misspelling | Keyword filters see strings, not intent. |
| Output filter | Fails on encoding | Blocking one literal answer misses every other way to say it. |
| Model judge | Can be talked around too | A second model is a second thing that can be talked around. |
| Tools and retrieval | Widens the damage | An agent doesn't just talk, it acts. |
A hidden instruction competes with every instruction that comes after it. Secrets and permissions belong in application code, not in the context window.
Build safer
Keep secrets and privileged decisions out of the model entirely. Enforce permissions in ordinary code.
Keyword filters see strings, not intent. Change the spacing, spelling, or language and the model still understands exactly what was asked.
Build safer
Clean up the input, judge what it is asking for, cap its length, and never let filtering be your only control.
Blocking one literal answer misses every other way to say it. Reversed text, fragments, synonyms, and clues all rebuild the same secret.
Build safer
Minimise sensitive context, validate structured outputs, and check meaning rather than exact strings.
A second model is a second thing that can be talked around. Attacker-controlled text can make it miss a leak, or follow instructions hidden in what it reviews.
Build safer
Tell the judge its input is untrusted, limit what it can reply, block by default when unsure, and back it with checks that are not a model.
An agent doesn't just talk, it acts. Tool descriptions, web pages, documents, and database rows can all carry instructions written to redirect it.
Build safer
Treat anything the agent reads as untrusted. Give each tool the least access it needs, ask a human before anything costly, and check every argument.
Remove secrets
If the model never receives a credential, it cannot repeat it.
Shrink permissions
Give every tool only the actions and data this task needs.
Validate actions
Check tool names and arguments in code; confirm high-impact actions with a human.
Attack it yourself
Write down every break, add it to your tests, then check the layer underneath.
Monitor and stop
Rate-limit, log safely, and provide a kill switch when behaviour drifts.