Prompt Injection as a Control/Data Boundary Problem
Reframing prompt injection as a control/data boundary problem enhances security. A two-channel design separates untrusted content from trusted instructions.
Prompt injection is often framed as a behavior issue in LLMs, but it can also be viewed as a control/data boundary problem. This perspective highlights the risks when untrusted text can influence application behavior without proper verification. The proposed two-channel design separates untrusted content into a data plane and trusted instructions into a control plane, enhancing security by ensuring that only verified data can affect tool execution.