Prompt Injection › Key Parameters

The key parameters when designing injection defenses are:

• Detection threshold: The confidence score above which an input is classified as a potential injection. Lower thresholds improve recall (catching more injections) at the cost of more false positives. The optimal threshold is deployment-specific and depends on the relative cost of false positives versus false negatives.
• Pattern coverage: The breadth of injection patterns covered by rule-based filters. More patterns improve coverage but increase maintenance burden and the risk of false positives from legitimate queries that happen to match broad patterns.
• Tool access scope: The set of actions an agent can take even if fully compromised. Narrower scope limits the blast radius of a successful attack. Access scope should be calibrated per task rather than set globally.
• Privilege level granularity: How finely-grained the distinction is between system instructions, user input, and retrieved data when these are marked in the context. Coarser distinctions are easier to implement but provide weaker guarantees.
• Audit logging depth: Whether all tool calls and their arguments are logged, enabling detection of injection-driven anomalous behavior after the fact. Full logging is essential for forensic investigation and anomaly detection.
• Retraining cadence: How frequently the injection classifier is updated with newly discovered attack patterns. Classifiers that are never retrained become progressively more brittle as attackers publish evasion techniques.