AI prompt injection prevention

n pipelines.

Core Solution

Prompt injection prevention requires architectural enforcement, not heuristic guessing. The following implementation establishes a defense-in-depth pipeline that treats all external input as untrusted and all model output as unverified.

Step 1: Threat Boundary Definition

Map where user input enters the system. Classify vectors as direct (chat, form fields, API payloads) or indirect (RAG documents, webhooks, third-party data feeds). Assign trust levels to each context.

Step 2: Input Validation & Sanitization

Reject payloads that violate structural expectations before they reach the model. Use schema validation, not regex blacklists. Blacklists fail against encoding tricks, Unicode homoglyphs, and semantic paraphrasing.

Step 3: Prompt Isolation & Templating

Never concatenate user input into system prompts. Use structured message arrays with explicit role boundaries. Separate instructions from data.

Step 4: Context Segmentation (RAG Safety)

Tag retrieved documents with metadata. Enforce read-only boundaries. Strip executable patterns, HTML/JS, and instruction-like syntax before injection into the context window.

Step 5: Output Verification & Monitoring

Validate model responses against expected schemas. Implement content classification for policy violations. Log all prompt/response pairs for adversarial pattern detection.

TypeScript Implementation

import { z } from 'zod';
import { createHash } from 'crypto';

// 1. Input schema validation
const UserQuerySchema = z.object({
  query: z.string().min(1).max(2000),
  context_id: z.string().uuid().optional(),
  role: z.enum(['user', 'agent', 'system']).default('user'),
  metadata: z.record(z.unknown()).optional()
});

// 2. Prompt isolation guard
class PromptGuard {
  private readonly MAX_TOKENS = 4096;
  private readonly SYSTEM_BOUNDARY = '###SYSTEM_INSTRUCTIONS###';
  private readonly USER_BOUNDARY = '###USER_INPUT###';

  async validateInput(raw: unknown): Promise<z.infer<typeof UserQuerySchema>> {
    const parsed = UserQuerySchema.parse(raw);
    
    // Reject control characters and excessive whitespace
    if (/[\x00-\x1F\x7F-\x9F]/.test(parsed.query)) {
      throw new Error('Invalid control characters detected');
    }
    
    // Hash for audit trail
    parsed.metadata = { ...parsed.metadata, input_hash: createHash('sha256').update(parsed.query).digest('hex') };
    return parsed;
  }

  // 3. Structured prompt construction
  buildPrompt(systemInstructions: string, userQuery: string, retrievedContext?: string): string[] {
    const messages: { role: 'system' | 'user' | 'assistant'; content: string }[] = [];
    
    // System prompt stays isolated
    messages.push({
      role: 'system',
      content: `${this.SYSTEM_BOUNDARY}\n${systemInstructions}\n${this.SYSTEM_BOUNDARY}`
    });

    // Context segmentation for RAG
    if (retrievedContext) {
      const sanitizedContext = this.sanitizeContext(retrievedContext);
      messages.push({
        role: 'user',
        content: `[REFERENCE DATA]\n${sanitizedContext}\n${this.USER_BOUNDARY}\n${userQuery}`
      });
    } else {
      messages.push({
        role: 'user',
        content: `${this.USER_BOUNDARY}\n${userQuery}`
      });
    }

    return messages;
  }

  // 4. Context sanitization
  private sanitizeContext(raw: string): string {
    return raw
      .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
      .replace(/```[\s\S]*?```/g, '[CODE_BLOCK_REDACTED]')
      .replace(/(?:ignore|override|disregard|system|admin)/gi, '[REDACTED]')
      .trim();
  }

  // 5. Output validation
  async validateOutput(response: string, expectedSchema?: z.ZodType): Promise<boolean> {
    if (expectedSchema) {
      try {
        expectedSchema.parse(JSON.parse(response));
        return true;
      } catch {
        return false;
      }
    }
    
    // Policy check for instruction leakage
    const leakagePatterns = [
      /system prompt/i,
      /ignore previous/i,
      /you are now/i,
      /override instructions/i
    ];
    
    return !leakagePatterns.some(pattern => pattern.test(response));
  }
}

export { PromptGuard };

Architecture Decisions & Rationale

Why structured message arrays over string concatenation? LLMs parse token sequences without inherent delimiters. Explicit role boundaries and separator tokens prevent instruction bleeding. Frameworks like OpenAI’s chat completions API enforce role separation at the API level, but downstream models and open-source deployments require explicit boundary markers.

Why schema validation over regex? Regex fails against semantic equivalence. "Ignore all prior rules" and "Disregard previous directives" bypass pattern matchers. Schema validation enforces structural contracts, while downstream classifiers handle semantic threats.

Why context segmentation? RAG pipelines are the primary vector for indirect injection. Malicious actors embed payloads in PDFs, web pages, or database records. Tagging, sanitizing, and bounding retrieved content prevents data poisoning from escalating to instruction override.

Why parallel validation? Security checks add latency. Running input validation, context sanitization, and output verification in parallel pipelines ensures the critical path remains under 20ms, preserving user experience while maintaining defense depth.

Pitfall Guide

1. Treating prompts as deterministic code
   Prompts are probabilistic instructions. They do not guarantee execution paths. Assuming a model will "obey" a system prompt is architecturally unsound. Always assume the model will follow the highest-probability token sequence, which adversarial inputs can manipulate.

2. Over-relying on blacklists and regex
   Blacklists are inherently reactive. New injection techniques emerge daily. Semantic paraphrasing, multilingual attacks, and encoding tricks bypass static patterns. Use schema validation, contextual classification, and behavioral monitoring instead.

3. Ignoring indirect injection in RAG pipelines
   Direct injection is obvious. Indirect injection is silent. Attackers poison knowledge bases with documents containing hidden instructions. When retrieved, these instructions override system prompts. Always sanitize and bound retrieved context before model ingestion.

4. Hardcoding system prompts as immutable strings
   System prompts degrade under distribution shift. Models learn to ignore repetitive or overly verbose instructions. Use dynamic prompt generation, role separation, and periodic adversarial testing to maintain boundary integrity.

5. Assuming output filtering is sufficient
   Output validation catches leaks but doesn’t prevent them. By the time malicious output is generated, the model has already processed injected instructions. Defense must occur at input and context boundaries, not just post-generation.

6. Skipping adversarial testing in CI/CD
   Security controls degrade without continuous validation. Integrate automated red-team suites into deployment pipelines. Test against known injection patterns, semantic variants, and distribution shifts before production rollout.

Production Best Practices:

• Implement least-privilege model calls: restrict function calling, tool use, and external API access to explicit allowlists.
• Version prompts alongside application code. Treat prompt changes as security-sensitive deployments.
• Monitor token-level anomalies: sudden shifts in completion length, role confusion, or instruction repetition indicate boundary violations.
• Use structured outputs (JSON schema) to constrain model responses and reduce injection surface area.

Production Bundle

Action Checklist

• Map all input vectors: identify direct and indirect entry points for user and third-party data
• Enforce schema validation: replace regex blacklists with strict structural contracts using Zod or equivalent
• Isolate system instructions: never concatenate user input into system prompts; use explicit role boundaries
• Sanitize RAG context: strip executable patterns, code blocks, and instruction-like syntax before retrieval injection
• Validate outputs against schemas: enforce structured responses and detect instruction leakage pre-delivery
• Integrate adversarial testing: automate red-team suites in CI/CD pipelines for continuous boundary verification
• Monitor token anomalies: track completion length shifts, role confusion, and repetition patterns for runtime detection

Decision Matrix

Scenario	Recommended Approach	Why	Cost Impact
Customer-facing chatbot	Multi-layer defense + output filtering	High attack surface; requires strict boundary enforcement and policy compliance	Medium (infra + monitoring)
Internal RAG knowledge base	Context segmentation + schema validation	Indirect injection risk dominates; data poisoning is primary threat vector	Low (sanitization pipeline)
Automated workflow agent	Prompt isolation + function allowlisting	Tool use expands attack surface; least-privilege prevents lateral escalation	High (guardrail service + audit logging)
Batch processing pipeline	Input validation + output verification	Latency tolerance allows heavier checks; batch size reduces per-unit overhead	Low (compute scaling)
Open-source model deployment	Multi-layer defense + structured outputs	No vendor safety filters; architectural enforcement is mandatory	Medium (custom guardrails + testing)

Configuration Template

// guardrails.config.ts
import { PromptGuard } from './prompt-guard';
import { z } from 'zod';

export const guardrailsConfig = {
  input: {
    schema: z.object({
      query: z.string().min(1).max(2000),
      context_id: z.string().uuid().optional(),
      role: z.enum(['user', 'agent', 'system']).default('user'),
      metadata: z.record(z.unknown()).optional()
    }),
    maxRetries: 3,
    timeoutMs: 150
  },
  context: {
    sanitize: true,
    stripCodeBlocks: true,
    maxChunkSize: 1500,
    allowedDomains: ['trusted-corp.com', 'internal-wiki.net']
  },
  output: {
    validateSchema: true,
    leakagePatterns: [
      /system prompt/i,
      /ignore previous/i,
      /you are now/i,
      /override instructions/i
    ],
    fallbackMessage: 'Unable to process request securely.'
  },
  monitoring: {
    logAll: true,
    alertThreshold: 0.85,
    retentionDays: 90
  }
};

export const guard = new PromptGuard();

Quick Start Guide

1. Install dependencies: npm install zod @anthropic-ai/sdk @openai/sdk
2. Initialize the guardrail instance: const guard = new PromptGuard();
3. Validate incoming requests: const safeInput = await guard.validateInput(req.body);
4. Construct isolated prompts: const messages = guard.buildPrompt(systemPrompt, safeInput.query, retrievedContext);
5. Verify responses before delivery: const isValid = await guard.validateOutput(response);

Deploy the pipeline behind your LLM client. Run adversarial test suites against the guardrail layer. Monitor token anomalies and false positive rates. Iterate prompt boundaries based on production telemetry.