A trust boundaryTrust boundaryThe line between context written by the developer or the user being served, and context anyone else controls, which must not be allowed to give orders.Where this is taught is the line between text you or your user control and text someone else controls. Before writing any defence, label every part of the context by who decides what it says, not by how it arrived.
Predict first
The rule used in this exercise: text is trusted only if your team (the system promptSystem promptThe developer's instructions, sent as the first message with the system role. The model gets it in the same sequence as the user's text; it carries more weight only through position and training.Where this is taught) or the user the assistant serves wrote it. Everything else is untrusted, even when it is clean. Whether the user counts as trusted depends on the product: for a personal email assistant the user is the principal; for a public support bot, the user can be the attacker.
Mark each of the six parts, then click the lines you think are planted instructions. Toggle "show as the model sees it" to see the labels disappear.
Click a line to flag it as an injected instruction; click again to unflag.
Illustrative context written for this lesson, not a real product and not a model output. Addresses use the reserved .example domain.
In the answer key, two parts are trusted and four are not. Two of the four untrusted parts carry a planted instruction; the other two are clean. Untrusted means "don't let it give orders", not "malicious".