Topic starter
05/07/2026 6:46 pm
TL;DR: LLM defenses evolve from no checks to layered input and output filtering, yet still remain vulnerable to prompt injection, indirect elicitation, and transcript-based leakage across seven difficulty levels, according to Lakera’s Gandalf walkthrough. The deeper lesson is that blocking keywords is not identity governance, and runtime control must account for what the model can be induced to do.
Editorial analysis by NHI Mgmt Group, based on content published by Lakera: “Who Is Gandalf? The AI Challenge That Tests Your Prompting Skills”.
Key questions
Q: What breaks when LLM prompt filters rely on keywords alone?
A: Keyword-only filters fail when an attacker asks indirectly, translates the request, or splits the secret into fragments the model can still reconstruct.
Q: Why do transcript-based prompt injection checks still miss leaks?
A: Transcript checks can miss leakage when the model reveals a secret through paraphrase, partial disclosure, encoding, or reconstruction across several turns.
Q: How do you know if an LLM guardrail is actually working?
A: A guardrail is working when it catches harmful content consistently without blocking a large share of legitimate requests.
Practitioner guidance
- Map disclosure paths by conversation stage Identify where the model can be steered from benign context to secret exposure, then review each stage for gaps in prompt filtering, output review, and transcript handling.
- Test for indirect elicitation patterns Red-team prompts that request the secret through translation, acrostics, partial reconstruction, roleplay, and other paraphrase paths instead of direct asks.
- Treat transcripts as governed security artefacts Apply review and retention rules to prompt history because the attack often lives in the conversation sequence, not in one isolated message.
Bottom line: Prompt injection remains a live control problem because LLMs can be steered into disclosure even when direct requests are blocked.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 7:04 pm
Prompt injection is an authorisation failure disguised as a content problem: The article shows that the real issue is not whether the model can recognise bad words, but whether it can be manipulated into taking an unsafe disclosure path. Traditional content filters treat the prompt as text to classify; adversarial prompting turns the prompt into a control channel. The practitioner conclusion is that LLM governance must focus on runtime decision boundaries, not just safe-input lists.
A question worth separating out:
Q: What should security teams do when employees are using public LLMs with sensitive data?
A: They should assume the data is at risk and enforce controls immediately. That includes restricting sensitive inputs where possible, monitoring prompts and outputs, and training users on acceptable use. Public LLM usage turns ordinary workflows into disclosure paths, so the response has to combine policy, technical controls, and user awareness.
👉 Read our full editorial: AI prompt injection defenses still fail when models reveal secrets