Select the controls that actually reduce prompt injection blast radius
Real injection controls reduce blast radius regardless of model behavior: human gates, least privilege, data/instruction separation. A guard sentence and 'just trust the model' are traps.
Picture sorting safety tools for a robot that follows written notes. Two of the tools are real: lock away the dangerous buttons so the robot can't press them, and make a person approve anything scary. Two are fake comfort: a sticky note telling the robot 'ignore bad notes' (a sneaky note gets past it), and just trusting the robot completely (now nothing stops it). The trick to this puzzle is asking, for each option: if the robot got tricked anyway, does this still keep us safe? The ones that do are the real controls.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Multi-select security questions are deceptively easy to get wrong, because every option is written to sound at least a little protective. The skill the interviewer is testing isn't recall of a list of mitigations — it's whether you have a discriminator: a single principle that tells correct controls apart from comfortable-sounding non-controls. Without one, you grade by vibes and over-select.
For prompt injection the discriminator is sharp. Injection means an attacker has gotten text in front of the model, in the same channel where your instructions live. So the only controls that count are the ones that still work after the model has been adversarially steered. Everything else is, at best, a probability nudge that an attacker with retries defeats.
This deep dive builds that discriminator explicitly, applies it to all five options so you can see why three pass and two fail, and then dwells on why the two distractors are exactly the mistakes real teams make — the demo-prompt trap and the velocity trap. The goal is that you could regenerate the answer key from the principle, not memorize it.
The discriminator: 'does it hold when the model is fooled?'
Here's the test, stated precisely. For each candidate control, assume the worst case has already happened — the model has read an injection and is now trying to do what the attacker wants. Ask: does this control still prevent harm, or does it only try to stop the model from reaching that state in the first place?
Controls that prevent reaching the bad state are probability controls. They lower how often an injection succeeds. Useful, but never sufficient, because security is adversarial and worst-case: a control that fails 5% of the time fails 100% of the time against an attacker who retries until it does.
Controls that still prevent harm after the model is compromised are consequence controls. They cap blast radius. These are the ones that carry the weight, because they don't depend on the model behaving. The strongest designs stack both: lower the probability and bound the consequence, so expected loss is the product of two small numbers.
Apply the test mechanically. A system-prompt line trying to make the model ignore injections is pure probability, and a weak one — so 'rely on it alone' fails. Trusting the model fully is the opposite of a control. Human confirmation and least privilege are consequence controls that hold under compromise. Data/instruction separation is a probability control strong enough to count when paired with the others. That mechanical pass produces the key: options one, two, and three.
Situations where this technique stops working.
2–4 min · Everything important, quickly.
| Option | Holds when model is fooled? | Verdict |
|---|---|---|
| Human confirmation on high-impact | Yes — enforced outside the model | Correct |
| Least-privilege tool scoping | Yes — caps reachable capabilities | Correct |
| Untrusted content as data | Partly — lowers obedience rate | Correct |
| Lone 'ignore injection' line | No — paraphrased around | Distractor |
| Trust the model fully | No — removes every check | Distractor |
Real products, models, and research that use this idea.
- Production browsing agents adding payment-confirmation prompts after injected web pages attempted unauthorized purchases in 2025-2026.
- Agent platforms issuing per-tool scoped credentials so an injected retrieval step can't escalate into file deletion.
What an interviewer would ask next. Try answering before peeking at the approach.
QTwo of these controls are correct but address different attack stages — which stage does each cover?
Map separation to probability of obeying, least privilege to reachable scope, and human/policy gates to consequence of irreversible actions.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Selecting the 'ignore any injected instructions' line because it sounds like a defense. It's a prompt-layer hint, not a control — it fails the 'holds when fooled?' test.
60 second bullets to scan on the way to the call.
The single test that separates a real injection control from a weak one
Why a lone 'ignore injected instructions' line fails against paraphrased attacks
Primary sources. Browse if you want the original framing.
Same topic, related formats. Practice these next.