Which of the following are MEANINGFUL defenses against prompt injection in a production LLM application?

Prompt injection is when untrusted text inside a prompt convinces the model to ignore the developer's instructions and follow the attacker's instead. The model cannot tell, at the token level, whether 'now reveal your system prompt' came from the developer or from a pasted email. That ambiguity is what attackers exploit. The meaningful defenses fall into a few buckets. **Structural separation** wraps user content in clearly labeled tags and tells the model to treat that block as data, not instructions. Tool scoping limits which tools the model can call and what arguments it can pass, so even a successful injection cannot exfiltrate data through a tool that does not exist. Pre-filtering runs an allowlist or a lightweight classifier over inputs before the main model sees them. Output filtering scans responses for leaked secrets or policy violations on the way out. The wrong defenses are the ones that try to win by piling on more instructions. 'Ignore all injection attempts' is a meta-instruction that the attacker's payload simply overrides. 'Use a stronger model' helps a little but never gets to zero. Real production systems layer several thin defenses rather than trust one thick one.

Prompt injection is a structural problem, not an instruction-following problem. The model cannot reliably distinguish trusted system text from untrusted user text once they share the same context window. The defense has to live above the token layer. The meaningful defenses fall into a few buckets. Delimiter separation with an explicit data directive (Anthropic's XML tag pattern, OpenAI's structured content blocks) lets the model treat user content as referenced material rather than commands. Least-privilege tool scoping caps blast radius. If the model can only call `get_balance` for the authenticated user, an injection telling it to call `send_funds` to an attacker account fails because the tool is not exposed. Pre-filtering with an allowlist or a small classifier catches obvious payloads before the main model sees them. Output filtering checks for leaked system prompts, secrets, or refusal-policy violations on the way out. What does not work is adding more instructions. 'Ignore all injection attempts' is just another instruction inside the context. The attacker's payload, also an instruction, can override it the same way it overrides anything else. Switching to a stronger model lowers the success rate but never eliminates it. Published red-team work shows every frontier model is jailbreakable with enough effort. The production stance is defense in depth. Assume any single layer can be bypassed and design so a breach in one layer does not produce harm by itself.