Delimiter Defence is a prompt-hardening technique that separates trusted instructions from untrusted content using clear boundaries or wrappers. Attackers try to smuggle instructions inside user input, documents, or retrieved text. Defenders use strong separation, allowlists, and explicit parsing rules so the model treats embedded content as data, not commands.
How Delimiter Defence Works
Delimiter Defence is a prompt-hardening pattern that creates explicit boundaries between trusted instructions and untrusted content. The goal is simple: make it harder for hidden directives inside user input, files, retrieved text, or tool output to be mistaken for instructions.
Well-designed delimiters do not rely on trust by location alone. They combine wrappers, clear parse rules, and instruction hierarchy so the system can treat embedded text as data unless a separate rule explicitly promotes it.
Where It Fits in Prompt Security
This technique is most useful anywhere a model consumes mixed-trust content, especially retrieval pipelines, document analysis, agent tool output, and copy-paste workflows. It reduces the chance that a malicious payload can blend into ordinary text and inherit the surrounding instruction context.
Prompt Injection Guide covers the broader attack patterns this control is designed to resist, including hidden instructions in documents, indirect prompt injection, and tool poisoning.
Delimiter Defence is not a substitute for access control or content filtering. It works best as one layer in a defence-in-depth design, alongside allowlisting, strict parsing, and explicit handling of retrieved or user-supplied content.
Common Failure Modes
The technique fails when delimiters are weak, inconsistent, or easy to bypass. If the model or surrounding application does not reliably separate instruction text from embedded content, attackers can smuggle commands through formatting tricks, encoded text, or nested wrappers.
Failures also happen when developers assume delimiters alone solve prompt injection. If downstream tools, retrieval sources, or model-facing templates still allow untrusted text to control execution, the boundary becomes cosmetic rather than protective.
Another common weakness is ambiguous parsing. When the system does not know exactly which text is authoritative, the model may overfit to the most persuasive or recent instruction rather than the intended instruction hierarchy.
Practical Security Value
Delimiter Defence helps preserve the trust boundary that prompt-based systems often blur. It is most effective when the application explicitly defines which sections are instructions, which are user data, and which are retrieved references.
For teams building agentic or retrieval-augmented systems, the benefit is not just cleaner prompts, but fewer opportunities for prompt injection to redirect behavior, exfiltrate data, or manipulate tool use.
MITRE D3FEND is useful for mapping delimiter-based hardening to broader defensive countermeasures, especially when you want to relate prompt hardening to a documented security-control vocabulary.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST AI RMF, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1056 — Input Capture | Prompt injection abuses how untrusted text is interpreted as commands. |
| Recommendation — Treat mixed-trust model inputs as hostile and test whether instruction boundaries are enforceable. | ||
| NIST AI RMF | GOVERN — Govern | Delimiter Defence is a governance choice for how AI systems separate trust boundaries. |
| Recommendation — Define and enforce prompt-handling rules that distinguish instructions from untrusted content. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Delimiter controls depend on validating and constraining untrusted input before model use. |
| Recommendation — Validate and constrain untrusted text before it can influence model behavior. | ||
| OWASP ASVS | V2 — Validation and Business Logic | The pattern relies on strict parsing and rejection of hostile embedded instructions. |
| Recommendation — Apply strict parsing and validation so embedded content cannot alter intended control flow. | ||
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Prompt boundaries help prevent malicious instructions from steering agent tool use. |
| Recommendation — Separate instructions from data before any agent tool action is permitted. | ||