The mitigation for sql injection attacks is to parameterize your queries- in other words, separating the “program” (the sql query syntax) from the “data” (the parameters to the sql query)

I am unaware of a similar mechanism for llms. Anthropic’s documentation talks about using xml tags to separate parts of a prompt, which sounds promising. However I’m not clear if that is really triggering a deterministic process in the llm to process that data differently, or if it’s just another “hint” to a non deterministic model.

Curious to hear from folks way more experienced than I am on this topic.