Mid-level interview questionAsked by candidates · YouTube
Do XML tags or delimiters around untrusted text stop prompt injection?
Model answer
They help, but they don't stop it. Tags tell the model which text is data, and a well-trained model mostly respects that. But tags are just more tokens in the same stream: an attacker can fake a closing tag, or simply persuade.
Scroll sideways to see the whole diagram
A model can be trained to rank instructions by where they come from, so a tool output loses to the system prompt.
Text version
- A model can be trained to rank instructions by where they come from, so a tool output loses to the system prompt.
- The prompt can name what is off-limits and mark untrusted text as data. Both rely on the model complying.
- System-level defences don't depend on the model: a tool it doesn't have can't be misused, and a send that needs approval can be declined.
- Layers reduce risk; none removes it. Plan for an attack that gets through.
Levels from AI Engineering, Ch. 5, "Defenses Against Prompt Attacks"; measures from OWASP LLM01:2025.
Use them as one layer, and keep the real control outside the model: limited tools, confirmation for risky actions, and filtered outputs.
Practise the rest
12 Prompt injection questions, 492 in all, each with a model answer. Free.
More Prompt injection interview questions
- Why is prompt injection possible at all, and why can't it be fixed the way special-token injection is?
- What is the difference between direct and indirect prompt injection? Give an example of each.
- Your assistant has no tool that sends anything. Can an injected web page still leak the user's data?
- You're designing an email assistant that reads, summarises and forwards mail. Which defences do you put in, and where?
- A reviewer says: “The system prompt forbids following instructions in emails, so the forward tool is safe, and our red-team run had zero violations.” Do you accept that?
- What's the difference between a jailbreak and a prompt injection?