LLM Security: Prompt Injection, Jailbreaking, and Defense Strategies

The LLM Security Threat Landscape

Prompt injection occurs when user-controlled input overrides system instructions. Direct injection: user message contains override instructions. Indirect injection (more dangerous): attacker-controlled content in web pages or documents the agent reads contains embedded instructions.

Defense Strategies

Pattern Detection

import re
PATTERNS = ['ignore.*instructions', 'you are now', 'new persona', 'system prompt']

def is_suspicious(text: str) -> bool:
    return any(re.search(p, text.lower()) for p in PATTERNS)

Privilege Separation

Never give an LLM more capabilities than needed for its task. An agent that reads emails should not also send them. Apply least privilege.

Output Parsing

Parse LLM outputs into structured data before acting. A JSON action object is safer than free-form text executed directly.

Human Confirmation Gate

For consequential actions (sending messages, purchases, record changes), require human confirmation. The LLM plans; the human approves.

Content Sandboxing

Process external content in a sandboxed agent with no tool access. The main agent receives only the sanitized extraction, never raw external content.