Prompt Firewall

Moves beyond regex pattern matching to understand the underlying goal of a prompt. By embedding both the system prompt and the user input into a shared vector space, the firewall detects when a user's instruction semantically diverges from or attempts to override the system's directives.

• Detects goal hijacking even with novel phrasing
• Compares user intent against a policy embedding baseline
• Blocks inputs that are semantically adversarial, not just lexically forbidden

Neutralizes obfuscation techniques by converting all inputs into a standardized, canonical form before analysis. This strips away the attacker's ability to hide payloads through encoding tricks.

• Collapses Unicode homoglyphs (e.g., 'а' vs 'a') to base characters
• Strips zero-width characters and invisible control codes
• Decodes nested encodings (Base64, URL-encoding) recursively
• Normalizes whitespace and delimiter abuse

Logically partitions the model's context into strict trust zones. System instructions, user input, and retrieved tool data are tagged with distinct privilege levels, preventing cross-zone contamination.

• Applies XML-style tagging or attention masks to separate data sources
• Prevents untrusted data from being interpreted as executable instructions
• Mitigates indirect prompt injection from poisoned RAG documents

Enforces that model outputs conform to a predefined, machine-readable schema before being returned to the calling application or executed as an action. This acts as a final validation layer.

• Validates outputs against JSON Schema or regex patterns
• Blocks free-form leakage of system prompts or sensitive context
• Rejects outputs containing unexpected tool calls or API invocations
• Ensures actions match the application's allowed capability set

Flags inputs that deviate statistically from natural language distributions. Adversarial suffixes, encoded payloads, and token smuggling attempts often produce abnormally high perplexity scores or unusual entropy patterns.

• Calculates token-level perplexity against a reference language model
• Detects gibberish suffixes generated by automated optimization tools
• Identifies token smuggling where malicious commands are split across benign-looking fragments

Embeds unique, decoy strings within the system prompt that act as digital tripwires. If a model is tricked into revealing its system instructions, the canary token appears in the output, triggering an immediate alert.

• Generates cryptographically unique strings invisible to users
• Monitors outputs for canary presence in real-time
• Provides high-signal detection of prompt extraction with near-zero false positives
• Integrates with SIEM and incident response pipelines

A safety framework that establishes a strict privilege ordering for instructions. System-level directives are assigned the highest priority, followed by user messages, with third-party data at the lowest tier. A prompt firewall enforces this hierarchy by ensuring lower-privilege inputs cannot override core operational constraints.

• Principle: System > User > Tool Output
• Implementation: Architectural separation in the context window
• Goal: Prevent privilege escalation via prompt injection

The process of cleansing user-supplied data before it reaches the language model. This includes removing or encoding potentially dangerous characters, normalizing Unicode to prevent homoglyph attacks, and stripping invisible control characters. Sanitization is a critical preprocessing step in any prompt firewall pipeline.

• Unicode normalization: NFC/NFKC canonical forms
• Control character stripping: Removing zero-width spaces and bidirectional markers
• Limitation: Cannot detect semantically adversarial prompts

A detection method that uses embedding models to understand the underlying intent of a prompt rather than relying on pattern matching. By comparing input embeddings against known adversarial examples in a vector space, semantic filters can block attacks regardless of phrasing or obfuscation.

• Technology: Cosine similarity search on embedding vectors
• Advantage: Catches paraphrased and obfuscated attacks
• Trade-off: Higher computational cost than regex-based filters

An architectural pattern that executes agent function calls in sandboxed environments to prevent a compromised model from directly affecting critical infrastructure. Even if a prompt firewall fails to block an injection, tool isolation limits the blast radius by enforcing least privilege on API access.

• Implementation: Containerized execution, gVisor, or Firecracker microVMs
• Policy: Strict allowlists on function parameters
• Synergy: Defense-in-depth complement to prompt firewalls