Defense in Depth — Layers, Not Patches

No single layer is enough

The defenses that work are stacked. Each catches some attacks; none catches all. Together they raise the cost and reduce the surface.

The layer stack

Trust boundaries in the prompt — explicit untrusted-content tags, refusal of imperatives inside data sections.
Privilege scoping — the model has only the tools it needs; nothing else is reachable.
Input filtering — strip or detect known-malicious patterns; classify high-risk inputs and route differently.
Output filtering — scan model output for sensitive data leaks, embedded URLs, attack indicators.
Verifier loops — verify any structured action ("send email") against business rules before executing.
Audit trails — log every input, output, and tool call with the prompt version that produced them.

Cost of layers

Each layer costs latency, complexity, or false positives. Don't add all of them everywhere — match layers to blast radius. A summarization endpoint needs less defense than a refund-issuing one.

Code

Output-filter layer (sketch)·python

import re

DANGEROUS_PATTERNS = [
    re.compile(r"<img[^>]*src=['\"]http"),     # exfil via image
    re.compile(r"\!\[.*\]\(http.+\?.*="),     # exfil via markdown
    re.compile(r"\b(?:[A-Za-z0-9._%+-]+)@(?:[A-Za-z0-9-]+\.)+[A-Za-z]{2,}\b"),  # raw email
]

def sanitize(output: str) -> str:
    for p in DANGEROUS_PATTERNS:
        output = p.sub("[redacted]", output)
    return output

Defense in Depth — Layers, Not Patches

No single layer is enough

The layer stack

Cost of layers

Code

External links

Exercise

Progress

Comments 0