Input Sanitization

The process of converting input data into a single, standard, unambiguous representation. Attackers frequently use encoding tricks like URL encoding, Unicode escapes, or double-encoding to bypass naive filters. Canonicalization decodes the input recursively until it reaches a base form, ensuring that %27 and ' are treated identically. This prevents homoglyph attacks where visually similar characters from different alphabets are used to smuggle malicious instructions past pattern-matching defenses.

A mitigation technique that uses special character sequences to create rigid boundaries between untrusted user input and trusted system instructions. By wrapping user content in markers like --- USER INPUT START --- and --- USER INPUT END ---, the model is explicitly trained or instructed to treat anything outside those delimiters as privileged. This structural separation prevents user text from being interpreted as system-level commands, a core vulnerability exploited in direct prompt injection attacks.

A defensive procedure that removes invisible Unicode characters from input strings. Characters like zero-width space (U+200B), zero-width joiner (U+200D), and byte order marks (U+FEFF) are invisible to human reviewers but can break tokenization, confuse parsers, or bypass keyword filters. Stripping these characters is essential because attackers use them to fragment malicious strings like D-E-L-E-T-E into tokens that a model might reassemble while evading detection.

Enforcing strict character or token limits on user input to prevent context window exhaustion attacks. An attacker can flood a model with thousands of tokens of filler text to push system instructions out of the model's effective attention window. By truncating input to a defined maximum before it enters the prompt assembly pipeline, the system guarantees that safety instructions and guardrails remain within the model's active context, preserving their influence over the final output.

The removal or escaping of ASCII control characters and terminal escape sequences that could be interpreted as formatting commands. Characters like null bytes (\0), carriage returns (\r), and ANSI escape codes can cause unexpected behavior in logging systems, databases, or downstream parsers. In the context of LLMs, these characters can interfere with the model's internal representation or be used to craft adversarial prompt injections that exploit implementation quirks in the serving infrastructure.

Beyond syntactic cleaning, semantic normalization rewrites user prompts into a safe, canonical form before they are combined with system instructions. This involves stripping imperative verbs that mimic system commands, removing phrases like 'ignore previous instructions,' and restructuring the input to be unambiguously data rather than instruction. This technique directly counters prompt leaking and instruction override attempts by ensuring user content can only be interpreted as a query, never as a directive.

The process of converting input data into a single, standard, unambiguous representation before any security checks are applied. Attackers frequently use encoding tricks like double URL-encoding (%2527) or Unicode normalization exploits to bypass sanitization filters. Canonicalization ensures that %27, ', and ' are all reduced to a single apostrophe character before analysis.

• Prevents homoglyph attacks using visually identical characters from different alphabets
• Defeats nested encoding where malicious payloads are encoded multiple times
• Must occur before any allow-list or block-list validation

A mitigation technique that uses special character sequences to clearly separate untrusted user input from trusted system instructions. By wrapping user input in XML tags like <user_query> or using markdown fences, the model learns to treat that content as data rather than instructions. This creates a strong context boundary that resists injection.

• Example: ### USER INPUT START ### ... ### USER INPUT END ###
• Works by exploiting the model's attention mechanism to segregate instruction from data
• Most effective when combined with system prompt hardening

The use of classifiers, heuristics, or perplexity analysis to identify user inputs that are likely crafted to manipulate a model. Unlike simple pattern matching, these detectors analyze the linguistic structure and statistical properties of prompts. A high-perplexity input—one the model finds surprising or unnatural—may indicate an obfuscated injection attempt.

• Perplexity scoring: Measures how 'surprising' token sequences are to the model
• Heuristic rules: Detect known injection patterns like 'ignore previous instructions'
• Often deployed as a pre-filter before sanitization or as a guard model

A Web Application Firewall-like layer that inspects and blocks malicious prompts at the API gateway before they reach the language model. This operates at the infrastructure level, applying rulesets, rate limiting, and signature-based detection to inbound requests. Unlike content-filter guard models, a Prompt Injection WAF can block attacks before they consume any model inference compute.

• Operates at Layer 7 of the network stack
• Can integrate with existing SIEM and threat intelligence feeds
• Provides centralized logging and alerting for injection attempts across all model endpoints

An attack that inserts invisible Unicode characters into text to break tokenization or keyword filtering without being visible to the user. Characters like U+200B (Zero-Width Space) or U+FEFF (BOM) can split keywords so that 'delete' becomes 'del​ete', evading block-lists while rendering identically to a human reviewer.

• Sanitization must explicitly strip Unicode control characters
• Can also break rate limiting by making identical requests appear unique
• Often combined with homoglyph attacks for multi-layered evasion

A safety framework that prioritizes system-level instructions over user-level or tool-level instructions to prevent lower-privilege inputs from overriding core directives. In this model, the system prompt is treated as the highest authority, user input as subordinate, and tool outputs as the lowest priority. This creates a formal privilege model that sanitization alone cannot enforce.

• System > User > Tool is the standard privilege ordering
• Requires the model to be trained to recognize and respect this hierarchy
• Complements input sanitization by providing a defense-in-depth architectural guarantee