separating-prompt-data-reserved-delimiters-fine-tuning-structure-blocks CLM-0149mechanismsingle paperReviewed by AI and Russ Miller
Separating prompt and data with reserved delimiters and fine-tuning on that structure blocks most injections at little cost to utility.
Capability: Following instructions hidden in data
Sources
- Separating prompt and data with reserved delimiters and fine-tuning on that structure blocks most injections at little cost to utility.
Either way, bring evidence: a link, or what you saw.
Disagreeing is the most useful thing you can do here. Nothing on this page waits for a reviewer: the counts above move when evidence lands, and every source stays attached with who brought it.
Related claims
- Prompt injection defenses that report near-zero attack success on short-context benchmarks lose most of that protection when the injected instruction sits inside a document of thousands to tens of thousands of tokens: fine-tuned separation defenses and detect-localize-remove pipelines still let a large share of injections through on paper review, resume screening, code review and email threads.Following instructions hidden in data · reviewed by AI
- Separating instructions from data raises injection resistance substantially, but both published versions get their strength from fine-tuning the model on the separation, and both report improved robustness rather than elimination. Treat it as one layer of defense in depth; the prompt-only variant, without training, has no measured efficacy behind it here.Following instructions hidden in data