prompt-injection-defense

Prompt Injection Defense

Design for compromise of model reasoning. Prompt text and classifiers can reduce attack success, but they do not create a reliable security boundary. Keep consequential authority, authorization, validation, and policy enforcement outside the model.

Inputs

Collect or infer, and label assumptions for:

• Agent purpose, system/developer instructions, models, memory, and orchestration
• Every input source, including users, web pages, email, documents, images, audio, tool results, RAG, and other agents
• Tool list, privileges, identities, targets, write effects, and network egress
• Secrets, private data, system prompts, policy data, and other protected assets
• Output sinks such as UI rendering, code execution, messages, databases, and downstream agents
• Authorization model, human gates, monitoring, incident history, and risk tolerance
• Representative benign tasks and a safe evaluation environment

Do not request production secrets or malicious artifacts in chat. Use redacted samples or synthetic fixtures.

Output contract

Deliver:

1. A data-flow and trust-boundary map covering protected assets, all modalities, sinks, memory stores, agent hops, approved destinations, and credential boundaries
2. A threat model listing protected assets, attacker-controlled channels, injection paths, and security invariants
3. A prioritized defense plan that maps each path to preventive, limiting, detective, and recovery controls, each marked missing, planned, implemented, or verified
4. Code or configuration changes only within the user's authorized scope
5. A regression suite with safe direct, indirect, stored, encoded, cross-agent, and multimodal cases as applicable
6. Verification evidence, observed failures, and metrics rather than a blanket claim of prevention
7. Residual risk, operational monitoring, and an incident containment/recovery plan

Describe the architecture in a JSON boundary manifest and lint it with scripts/audit_boundary_manifest.py. Record every control's enforcement point, owner, evidence IDs, test IDs, and expiry when time-limited. A passing structural lint is not evidence that controls work. Read references/defense-patterns.md for attack paths, control placement, and verification patterns.