Delimiter-Based Defense

Uses special character sequences (e.g., ---, ###, XML tags like <user_input>) to create an unambiguous separation between system and user content. The model is explicitly instructed to treat everything within the delimited block as inert data rather than executable instructions. This prevents the model from interpreting user-supplied text as a continuation of the system prompt.

• Common delimiters: triple backticks, XML tags, hash sequences
• Works by exploiting the model's ability to follow formatting conventions
• Most effective when combined with explicit instructions to ignore delimited content

Maintains the privilege separation between system-level directives and user-level data. By physically isolating user input within delimiters, the defense ensures that system instructions retain their highest-priority position in the model's attention mechanism. This prevents lower-privilege user content from overriding core safety directives.

• System prompt remains outside and above the delimited zone
• User content is explicitly labeled as lower-trust
• Prevents privilege escalation through prompt crafting

Delimiter-based defenses can be bypassed if attackers use encoding tricks to hide malicious delimiters within user input. Robust implementations must include canonicalization steps that normalize input before delimiter parsing. This includes handling Unicode homoglyphs, escape sequences, and nested delimiter injection attempts.

• Must handle Unicode normalization (NFC/NFD forms)
• Defend against delimiter injection within delimited blocks
• Combine with input sanitization for layered defense

Extends the delimiter concept beyond text to multi-modal inputs such as images, audio, and video. In these contexts, delimiters may take the form of metadata tags, base64 encoding wrappers, or temporal markers that separate trusted media from untrusted uploads. This prevents injection attacks embedded in non-text modalities from contaminating the model's instruction context.

• Image inputs wrapped in <image> XML tags
• Audio segments marked with timestamp boundaries
• Prevents cross-modal prompt leakage

Delimiter-based defense is not a standalone solution but a foundational layer within a broader security architecture. It works synergistically with guard models, input sanitization, and structured output enforcement to create defense-in-depth. If an attacker bypasses delimiters, secondary filters catch the injection before execution.

• First line: delimiter segregation
• Second line: perplexity-based injection detection
• Third line: output content filtering
• Follows the Prompt Injection Kill Chain model

Protects against context window exhaustion attacks by ensuring that even when an attacker floods the input with filler content, the delimited structure preserves the system prompt's position. The model is trained to prioritize instructions outside the delimited zone, maintaining safety guardrails even under high-volume input conditions.

• System instructions remain at fixed positions
• Delimited user content can be truncated without losing safety
• Prevents displacement of core directives