training · structured-prompt-separation TEC-0025

Separate instructions from data

Mark the boundary between trusted instructions and untrusted content, and train or prompt the model to honor it.

Wrap tool outputs and retrieved documents in reserved delimiters the model has been trained to treat as data, strip those delimiters from untrusted content, and rank instructions by source privilege. Without training access, the prompt-level version still helps: label every untrusted block and instruct the model to never follow instructions inside it.

Addresses: Following instructions hidden in data

Contexts: Retrieval-augmented QA, Autonomous agent, Coding agent

Does it work?

supported so far2 supporting · 0 contesting sources · last moved 2026-09-04

Efficacy claims — what this technique actually moves, under which conditions, and whether that has been contested.

Needs: access to train the weights

Cost: high

Fails when:

It is used prompt-only, without training, where it has no measured efficacy. Even trained, it reduces rather than eliminates injection, so it is one layer of defence in depth. (helps, narrowly)

1 more condition from claims reviewed by AI, listed with the claims below.

mechanismreplicated
Separating instructions from data raises injection resistance substantially, but both published versions get their strength from fine-tuning the model on the separation, and both report improved robustness rather than elimination. Treat it as one layer of defense in depth; the prompt-only variant, without training, has no measured efficacy behind it here.
- supports StruQ: Defending Against Prompt Injection with Structured Queries (2024)
- supports The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions (2024)

Code

https://github.com/Sizhe-Chen/StruQ — StruQ training and evaluation code.verified 2026-09-02

Sources

Either way, bring evidence: a link, or what you saw.

Whether a technique works is a claim. What you file here becomes a claim about this technique under the capability it addresses, with your evidence as its source, and moves the standing above the same way a paper would.