Wrap every prompt chunk with a tag declaring its origin (trusted vs untrusted, retrieval vs tool vs attachment) so the model treats untrusted spans as data, and so auditors can trace what was trusted.
Picture a courtroom. Every piece of paper handed to the judge has a label on the corner: 'sworn testimony,' 'exhibit from prosecution,' 'note from the gallery.' The judge reads them all, but only acts on the sworn testimony. The gallery note is information, not an order. Content-provenance tagging works the same way for a language model. Each chunk of the prompt comes with a label saying where it came from, and the model is told to act only on the trusted ones. The untrusted ones are still useful as context, but they cannot tell the model what to do.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Indirect prompt injection is the dominant unsolved attack class for retrieval-augmented and agentic LLM systems. The attacker does not write to the chat box; the attacker writes to a document, an email, or a tool response that will later land inside someone else's prompt. Once the malicious text is inside the context window, it competes with the system prompt for the model's attention.
Content-provenance tagging is the cheap structural layer that addresses this. It does not eliminate the threat, that would require capabilities the current model class does not have, but it gives the model a clear cue about which spans to treat as instructions and which to treat as data, and it gives operators a structured prompt they can audit after the fact. This deep dive walks the tag taxonomy, the prompt-assembly contract, the empirical effect on injection compliance, the failure modes, and how the layer composes with stronger controls.
The tag taxonomy and why it matters
The taxonomy reflects production trust topology. The common five tags are:
trusted_developer, the system prompt itself, the developer's instructions, policy text, schemastrusted_user, the current end user's input, after authentication and any input-side classificationuntrusted_retrieval, chunks pulled from a vector database, knowledge base, or web searchuntrusted_tool_output, return values from tools the model invoked (database rows, API responses, file contents)untrusted_attachment, user-uploaded files or images decoded into text
The split between the three untrusted_* channels matters because they have different threat models. Retrieval can be poisoned by anyone who can write to the corpus. Tool output is bounded by what the tool returns. Attachments are bounded by what the user uploaded. Tagging them separately lets the system prompt express different policies per channel and lets auditors see which channel was the injection vector.
Some teams add trusted_system_output for previously-generated assistant text that has been validated and re-inserted. Others split untrusted_retrieval by source corpus. The taxonomy is configurable; the principle is that every chunk has exactly one tag and the model is told what each tag means.
Situations where this technique stops working.
2–4 min · Everything important, quickly.
Real products, models, and research that use this idea.
- Anthropic's Claude system-prompt patterns explicitly recommend wrapping retrieved content in `<document>` tags with source metadata
- OpenAI's structured-output and function-calling guides recommend explicit role tagging for retrieved content in agentic workflows
What an interviewer would ask next. Try answering before peeking at the approach.
QHow would you prevent tag spoofing in a hostile retrieval corpus?
Generate per-request random delimiters or HMAC tags. Reject any retrieved content that already contains the chosen delimiter string. Some teams also validate that the model's response structure matches the expected tag set in the prompt.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Adding the tags but never wiring the system prompt to actually instruct the model on how to treat each tag, the tags then become decoration with no behavioural effect.
60 second bullets to scan on the way to the call.
Tag taxonomy: trusted_user, trusted_developer, untrusted_retrieval, untrusted_tool_output, untrusted_attachment
System-prompt policy that ties each tag to a behavioural rule
Primary sources. Browse if you want the original framing.
Same topic, related formats. Practice these next.