Join our Newsletter — 33% off our NHI Course

Prompt sanitisation

Prompt sanitisation removes or neutralises input patterns that could manipulate an AI system or corrupt its instructions. It is a defensive control for prompt integrity, designed to reduce injection risk before the model processes the request.

What Prompt Sanitisation Does

Prompt sanitisation sits in front of the model and removes, rewrites, or neutralises input patterns that try to override instructions, smuggle hidden directives, or alter the request’s intent. It is a preventative control for prompt integrity, not a guarantee that the downstream model will behave safely.

In practice, sanitisation is usually one layer in a broader control stack. It can help standardise user input, strip suspicious markup or delimiter patterns, and reduce the chance that obviously malicious text reaches the model in an actionable form.

Where It Fits in AI Security

Prompt sanitisation matters because LLMs treat text as both content and instruction context, so malformed or adversarial input can create ambiguity. The control is strongest when it is paired with strict instruction hierarchy, output validation, and downstream policy enforcement, rather than used as a standalone filter.

It is especially relevant where the application accepts free-form user text, retrieves external content, or chains multiple prompts together. Those conditions increase the chance that a later prompt will inherit unsafe instructions from earlier input.

Common Sanitisation Techniques

Effective sanitisation usually targets the exact patterns that create instruction confusion, not just generic bad words. That can include escaping special delimiters, rejecting control tokens, normalising encoding, trimming unexpected system-style phrases, and separating user content from trusted instructions.

  • Normalisation reduces ambiguity caused by mixed encodings, invisible characters, or odd whitespace.
  • Structural filtering helps keep user input in a content-only field instead of letting it resemble a system or developer message.
  • Context separation preserves the difference between trusted policy text and untrusted user text.

Sanitisation should be calibrated carefully. Over-filtering can damage legitimate prompts, while under-filtering leaves obvious injection patterns intact.

What Prompt Sanitisation Can and Cannot Do

Sanitisation lowers attack surface, but it does not prove the prompt is safe. Attackers can still use paraphrase, indirection, encoding tricks, multilingual content, or harmless-looking text that becomes dangerous only in context.

That means the control should be treated as reduction, not elimination, of prompt injection risk. The model, surrounding application, retrieval layer, and tool permissions still need separate guardrails.

Risk and Threat Considerations

Prompt sanitisation is a defensive layer against instruction manipulation, but it can fail when attackers find ways to preserve intent while evading the filter. The risk is highest in systems that process untrusted text from users, documents, emails, websites, or retrieval sources.

Failure mechanism: The sanitiser misses paraphrased, encoded, or context-dependent injection content, or it strips too little and allows unsafe directives to remain semantically active. Poorly designed filters can also remove benign structure while leaving the malicious instruction intact.

Impact: The model may follow attacker-supplied instructions, leak sensitive context, produce policy-violating output, or trigger unsafe downstream actions through connected tools and workflows.

For a broader sanitisation and integrity lens, NIST SP 800-88 Media Sanitization is useful because it formalises clearing, purging, and destruction as integrity-preserving handling steps for information-bearing material.

For agentic and AI-specific threat modelling, MITRE ATLAS adversarial AI threat matrix helps map prompt injection, context poisoning, and related abuse patterns to a structured threat vocabulary.

For AI system governance and defensive design, NIST AI Risk Management Framework provides a practical way to connect prompt controls to broader trustworthiness and risk management outcomes.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST AI RMF, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
NIST AI RMF Govern Prompt sanitisation is an AI risk control for trustworthy system behaviour.
Recommendation — Map prompt sanitisation into AI risk governance and verify it as part of the system's trust controls.
NIST SP 800-53 Rev 5 SI-10 — Information Input Validation Prompt sanitisation is a form of validating and constraining untrusted input.
SI-4 — System Monitoring Prompt abuse is often detected through monitoring of malformed or injection-like inputs.
Recommendation — Apply SI-10 to normalise, filter, and validate prompt input before model processing. Use SI-4 to detect suspicious prompt patterns and correlate them with downstream model abuse.
OWASP ASVS V1 — Encoding and Sanitization Prompt sanitisation mirrors the same integrity concerns as input encoding and sanitisation in applications.
Recommendation — Treat prompt text as untrusted input and sanitize it before it reaches execution context.
MITRE ATT&CK T1059 — Command and Scripting Interpreter Prompt injection abuses instruction-like text to influence execution behavior.
Recommendation — Map prompt injection paths to execution-abuse techniques and hunt for instruction hijacking patterns.

Practitioner Guidance

Why practitioners should care: Prompt sanitisation is useful only when teams treat it as part of a layered prompt-security design. For high-risk applications, the better question is whether the system also constrains instruction precedence, tool use, and output handling, because sanitisation alone cannot enforce trust boundaries.

Common misunderstanding: A sanitiser that catches obvious jailbreak phrases is not the same as prompt security. The real control objective is to preserve the distinction between trusted instructions and untrusted content across every stage where text is composed, retrieved, or transformed.