LTBD: Learnable Trust-Boundary Delimiters for Prompt Injection Defense

Summary

Researchers introduce Learnable Trust-Boundary Delimiters (LTBD), a defense against prompt injection that uses a small number of learnable delimiters to separate trusted user instructions from untrusted external data, without changing LLM parameters. On AlpacaFarm, LTBD achieves 0.00% ASR, and on TaskTracker it achieves 0.11-0.19% ASR. The authors report that it outperforms inference-time defenses, is competitive with training-based approaches, and remains effective under adaptive attacks.

Mitigation

LTBD is the proposed defense: a lightweight method that adds learnable trust-boundary delimiters to the input to distinguish trusted user instructions from untrusted external data, keeping LLM parameters unchanged.

Topics

• Prompt injection and jailbreaks

Related items

• LowSocial Engineering AI Agents: The New BEC for 2026Similar attack · Dark Reading
• MediumGHSA-hmq2-7hp6-7crh: Banks: User-controlled prompt input can be parsed as privileged chat messagesSimilar attack · GitHub Advisory Database
• CriticalGHSA-9mp3-24cc-77mg: PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool CallsSimilar attack · GitHub Advisory Database
• Medium'AgentCorruption' Puts AWS Environments At Risk With Single PromptSimilar attack · Dark Reading
• MediumGHSA-4xxv-6wmf-xf45: PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspaceSimilar attack · GitHub Advisory Database