SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/ai-prompt-defense-limits

Can one prompt filter fully prevent every injection attack?

No. Current mitigations do not cover every attacker technique.

Start playing free

  1. Yes, one warning is enough
  2. No, use defense in depth ✔
  3. Only larger models are immune

Why: Filtering, detection, and instruction separation can reduce risk, but none is complete. Systems should also constrain permissions and expose untrusted data through narrow interfaces.

Huh, didn't know that: NIST suggests using components with different permissions when untrusted input is unavoidable.

The dad joke
One filter tried to catch every trick and requested a larger net.
Like this card?
Play the game

References

Answer: No, use defense in depth. Filtering, detection, and instruction separation can reduce risk, but none is complete. Systems should also constrain permissions and expose untrusted data through narrow interfaces.

  1. NIST Adversarial Machine Learning Taxonomy nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf
    current mitigations do not offer full protection against all attacker techniques
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Artificial IntelligenceWhat weakness does a direct prompt injection exploit?Artificial IntelligenceWhere does an indirect prompt injection hide?Artificial IntelligenceHow do AI, machine learning and deep learning fit together?

That's stuff everyone should know.