training · structured-prompt-separation

Separate instructions from data

Mark the boundary between trusted instructions and untrusted content, and train or prompt the model to honor it.

Wrap tool outputs and retrieved documents in reserved delimiters the model has been trained to treat as data, strip those delimiters from untrusted content, and rank instructions by source privilege. Without training access, the prompt-level version still helps: label every untrusted block and instruct the model to never follow instructions inside it.

Addresses: Following instructions hidden in data

Contexts: Retrieval-augmented QA, Autonomous agent, Coding agent

Does it work?

supported so far2 supporting · 0 contesting sources · last moved 2026-09-04

Efficacy claims — what this technique actually moves, under which conditions, and whether that has been contested.

mechanismreplicated
Separating instructions from data raises injection resistance substantially, but both published versions get their strength from fine-tuning the model on the separation, and both report improved robustness rather than elimination. Treat it as one layer of defense in depth; the prompt-only variant, without training, has no measured efficacy behind it here.

Code

https://github.com/Sizhe-Chen/StruQ — StruQ training and evaluation code.verified 2026-09-02

Does it work?

Code

Sources