delimiter-based protection

**Delimiter-based protection** is the **prompt-hardening technique that uses explicit boundary markers to separate trusted instructions from untrusted input content** - it improves parsing clarity and reduces accidental instruction confusion. **What Is Delimiter-based protection?** - **Definition**: Wrapping user or retrieved text within clearly labeled delimiters such as tags or fenced blocks. - **Security Intent**: Signal to the model that bounded content should be treated as data, not governing instructions. - **Implementation Pattern**: Pair delimiters with explicit directives about trust and execution behavior. - **Limitations**: Delimiters alone cannot fully prevent sophisticated injection attempts. **Why Delimiter-based protection Matters** - **Context Clarity**: Reduces ambiguity between control instructions and payload content. - **Defense Foundation**: Provides baseline hygiene for prompt security architecture. - **Debuggability**: Structured boundaries make prompt behavior easier to inspect and test. - **Composability**: Works alongside policy filters and authorization checks. - **Low Overhead**: Simple to implement in most prompt assembly pipelines. **How It Is Used in Practice** - **Boundary Standardization**: Enforce consistent delimiter schema across all input channels. - **Escaping Rules**: Sanitize embedded delimiter-like tokens in untrusted content. - **Layered Controls**: Combine delimitering with classifier-based risk detection and tool gating. Delimiter-based protection is **a useful but incomplete prompt-security control** - clear data boundaries improve robustness, but effective injection defense requires additional enforcement layers.