AI prompt injection prevention

cters detected'); }

// Hash for audit trail
parsed.metadata = { ...parsed.metadata, input_hash: createHash('sha256').update(parsed.query).digest('hex') };
return parsed;

}

// 3. Structured prompt construction buildPrompt(systemInstructions: string, userQuery: string, retrievedContext?: string): string[] { const messages: { role: 'system' | 'user' | 'assistant'; content: string }[] = [];

// System prompt stays isolated
messages.push({
  role: 'system',
  content: `${this.SYSTEM_BOUNDARY}\n${systemInstructions}\n${this.SYSTEM_BOUNDARY}`
});

// Context segmentation for RAG
if (retrievedContext) {
  const sanitizedContext = this.sanitizeContext(retrievedContext);
  messages.push({
    role: 'user',
    content: `[REFERENCE DATA]\n${sanitizedContext}\n${this.USER_BOUNDARY}\n${userQuery}`
  });
} else {
  messages.push({
    role: 'user',
    content: `${this.USER_BOUNDARY}\n${userQuery}`
  });
}

return messages;

}

// 4. Context sanitization private sanitizeContext(raw: string): string { return raw .replace(/<script\b[^<](?:(?!</script>)<[^<])*</script>/gi, '') .replace(/[\s\S]*?/g, '[CODE_BLOCK_REDACTED]') .replace(/(?:ignore|override|disregard|system|admin)/gi, '[REDACTED]') .trim(); }

// 5. Output validation async validateOutput(response: string, expectedSchema?: z.ZodType): Promise<boolean> { if (expectedSchema) { try { expectedSchema.parse(JSON.parse(response)); return true; } catch { return false; } }

// Policy check for instruction leakage
const leakagePatterns = [
  /system prompt/i,
  /ignore previous/i,
  /you are now/i,
  /override instructions/i
];

return !leakagePatterns.some(pattern => pattern.test(response));

} }

export { PromptGuard };

### Architecture Decisions & Rationale

**Why structured message arrays over string concatenation?** LLMs parse token sequences without inherent delimiters. Explicit role boundaries and separator tokens prevent instruction bleeding. Frameworks like OpenAI’s chat completions API enforce role separation at the API level, but downstream models and open-source deployments require explicit boundary markers.

**Why schema validation over regex?** Regex fails against semantic equivalence. "Ignore all prior rules" and "Disregard previous directives" bypass pattern matchers. Schema validation enforces structural contracts, while downstream classifiers handle semantic threats.

**Why context segmentation?** RAG pipelines are the primary vector for indirect injection. Malicious actors embed payloads in PDFs, web pages, or database records. Tagging, sanitizing, and bounding retrieved content prevents data poisoning from escalating to instruction override.

**Why parallel validation?** Security checks add latency. Running input validation, context sanitization, and output verification in parallel pipelines ensures the critical path remains under 20ms, preserving user experience while maintaining defense depth.

## Pitfall Guide

1. **Treating prompts as deterministic code**  
   Prompts are probabilistic instructions. They do not guarantee execution paths. Assuming a model will "obey" a system prompt is architecturally unsound. Always assume the model will follow the highest-probability token sequence, which adversarial inputs can manipulate.

2. **Over-relying on blacklists and regex**  
   Blacklists are inherently reactive. New injection techniques emerge daily. Semantic paraphrasing, multilingual attacks, and encoding tricks bypass static patterns. Use schema validation, contextual classification, and behavioral monitoring instead.

3. **Ignoring indirect injection in RAG pipelines**  
   Direct injection is obvious. Indirect injection is silent. Attackers poison knowledge bases with documents containing hidden instructions. When retrieved, these instructions override system prompts. Always sanitize and bound retrieved context before model ingestion.

4. **Hardcoding system prompts as immutable strings**  
   System prompts degrade under distribution shift. Models learn to ignore repetitive or overly verbose instructions. Use dynamic prompt generation, role separation, and periodic adversarial testing to maintain boundary integrity.

5. **Assuming output filtering is sufficient**  
   Output validation catches leaks but doesn’t prevent them. By the time malicious output is generated, the model has already processed injected instructions. Defense must occur at input and context boundaries, not just post-generation.

6. **Skipping adversarial testing in CI/CD**  
   Security controls degrade without continuous validation. Integrate automated red-team suites into deployment pipelines. Test against known injection patterns, semantic variants, and distribution shifts before production rollout.

**Production Best Practices**:
- Implement least-privilege model calls: restrict function calling, tool use, and external API access to explicit allowlists.
- Version prompts alongside application code. Treat prompt changes as security-sensitive deployments.
- Monitor token-level anomalies: sudden shifts in completion length, role confusion, or instruction repetition indicate boundary violations.
- Use structured outputs (JSON schema) to constrain model responses and reduce injection surface area.

## Production Bundle

### Action Checklist
- [ ] Map all input vectors: identify direct and indirect entry points for user and third-party data
- [ ] Enforce schema validation: replace regex blacklists with strict structural contracts using Zod or equivalent
- [ ] Isolate system instructions: never concatenate user input into system prompts; use explicit role boundaries
- [ ] Sanitize RAG context: strip executable patterns, code blocks, and instruction-like syntax before retrieval injection
- [ ] Validate outputs against schemas: enforce structured responses and detect instruction leakage pre-delivery
- [ ] Integrate adversarial testing: automate red-team suites in CI/CD pipelines for continuous boundary verification
- [ ] Monitor token anomalies: track completion length shifts, role confusion, and repetition patterns for runtime detection

### Decision Matrix

| Scenario | Recommended Approach | Why | Cost Impact |
|----------|---------------------|-----|-------------|
| Customer-facing chatbot | Multi-layer defense + output filtering | High attack surface; requires strict boundary enforcement and policy compliance | Medium (infra + monitoring) |
| Internal RAG knowledge base | Context segmentation + schema validation | Indirect injection risk dominates; data poisoning is primary threat vector | Low (sanitization pipeline) |
| Automated workflow agent | Prompt isolation + function allowlisting | Tool use expands attack surface; least-privilege prevents lateral escalation | High (guardrail service + audit logging) |
| Batch processing pipeline | Input validation + output verification | Latency tolerance allows heavier checks; batch size reduces per-unit overhead | Low (compute scaling) |
| Open-source model deployment | Multi-layer defense + structured outputs | No vendor safety filters; architectural enforcement is mandatory | Medium (custom guardrails + testing) |

### Configuration Template

```typescript
// guardrails.config.ts
import { PromptGuard } from './prompt-guard';
import { z } from 'zod';

export const guardrailsConfig = {
  input: {
    schema: z.object({
      query: z.string().min(1).max(2000),
      context_id: z.string().uuid().optional(),
      role: z.enum(['user', 'agent', 'system']).default('user'),
      metadata: z.record(z.unknown()).optional()
    }),
    maxRetries: 3,
    timeoutMs: 150
  },
  context: {
    sanitize: true,
    stripCodeBlocks: true,
    maxChunkSize: 1500,
    allowedDomains: ['trusted-corp.com', 'internal-wiki.net']
  },
  output: {
    validateSchema: true,
    leakagePatterns: [
      /system prompt/i,
      /ignore previous/i,
      /you are now/i,
      /override instructions/i
    ],
    fallbackMessage: 'Unable to process request securely.'
  },
  monitoring: {
    logAll: true,
    alertThreshold: 0.85,
    retentionDays: 90
  }
};

export const guard = new PromptGuard();

Quick Start Guide

1. Install dependencies: npm install zod @anthropic-ai/sdk @openai/sdk
2. Initialize the guardrail instance: const guard = new PromptGuard();
3. Validate incoming requests: const safeInput = await guard.validateInput(req.body);
4. Construct isolated prompts: const messages = guard.buildPrompt(systemPrompt, safeInput.query, retrievedContext);
5. Verify responses before delivery: const isValid = await guard.validateOutput(response);

Deploy the pipeline behind your LLM client. Run adversarial test suites against the guardrail layer. Monitor token anomalies and false positive rates. Iterate prompt boundaries based on production telemetry.