Input Clipping

The core mechanism is a hard cutoff applied before the input reaches the language model. Unlike semantic or perplexity filters, there is no ambiguity—any content exceeding the limit is simply discarded.

• Token-based clipping: Truncates based on the model's tokenizer count, ensuring the payload fits within a precise budget.
• Character-based clipping: A simpler, language-agnostic cutoff based on raw string length.
• Enforced at the API gateway: Applied before any other processing to guarantee no oversized input bypasses the check.

Many automated jailbreaking tools, such as Greedy Coordinate Gradient (GCG) attacks, append long sequences of seemingly nonsensical tokens to force compliance. Clipping directly neutralizes this technique.

• GCG suffixes often require hundreds of tokens to optimize an effective attack.
• A strict 100-token limit renders these optimization-based attacks impossible to execute.
• The defense is effective regardless of the suffix's content because it relies on length, not pattern matching.

Attackers use payload splitting to divide malicious instructions across multiple seemingly benign inputs, which are later reassembled by the model. Input clipping limits the complexity of each fragment.

• Fragment size restriction: Each individual input is too short to contain a meaningful piece of a complex attack.
• Reassembly disruption: The model cannot reconstruct a coherent malicious instruction from severely truncated fragments.
• Combined with session-level rate limiting, this creates a powerful defense against multi-turn injection attacks.

The primary drawback of input clipping is its impact on legitimate use cases. The limit must be chosen carefully to balance security with functionality.

• Truncation of genuine queries: Long, complex user requests may be cut off mid-sentence, degrading the user experience.
• Loss of context: Multi-paragraph documents or code blocks cannot be submitted for analysis.
• Mitigation strategy: Implement a tiered system where standard users have strict limits, while trusted, authenticated users receive higher thresholds.

Input clipping is most effective when deployed as part of a defense-in-depth strategy, typically at the outermost layer of a prompt firewall or API gateway.

• Pre-model enforcement: The truncation occurs before the input reaches the LLM, the guard model, or any other processing component.
• Combined with semantic filtering: Clipping handles length-based attacks, while a semantic filter catches short, direct injections like "ignore previous instructions."
• Observability: Log the number of truncated requests to monitor for potential attack campaigns without exposing the raw, potentially malicious content.

Token smuggling exploits discrepancies in how different tokenizers parse text to hide commands. A strict token limit reduces the available bandwidth for such obfuscation.

• Reduced encoding space: With fewer tokens available, attackers cannot embed complex multi-layered obfuscation.
• Homoglyph and Unicode attacks often inflate the token count of a string, making them more susceptible to clipping.
• Normalization synergy: Combine clipping with Unicode normalization (NFKC) to first collapse obfuscated characters, then truncate the result.

A statistical defense that flags inputs with abnormally high perplexity scores before they reach the model. Adversarial suffixes and obfuscated payloads often deviate sharply from natural language distributions, making them detectable.

• Calculates how 'surprised' a smaller language model is by the input
• Catches gibberish adversarial suffixes that clipping might not prevent
• Low latency overhead compared to semantic analysis
• Effective against automated optimization attacks

A detection method that uses embedding models to understand the underlying intent of a prompt rather than relying on keyword matching. This blocks inputs that are semantically adversarial regardless of how they are phrased or obfuscated.

• Compares input embeddings against known attack vectors
• Detects paraphrased injection attempts
• Language-agnostic when using multilingual embeddings
• Complements syntactic defenses like clipping

The defensive practice of reinforcing system prompts with explicit boundaries and fallback logic to resist adversarial manipulation. Even if an input bypasses clipping and other filters, a hardened prompt makes extraction and override significantly harder.

• Uses clear delimiter conventions (e.g., XML tags)
• Includes explicit 'do not reveal' instructions
• Implements refusal templates for boundary violations
• Adds canary tokens for leak detection

A strategy that logically partitions the context window to strictly separate untrusted data from system instructions. This prevents cross-context contamination even when long inputs are allowed through clipping thresholds.

• Places user input in a sandboxed context region
• Uses attention masking to isolate instruction tokens
• Prevents the model from treating data as directives
• Architectural defense rather than input-level filtering