Loading patterns…
Spotlighting & Data Marking(SDM)
A family of low-cost transformations that make untrusted external text reliably distinguishable from trusted instructions. Delimiting wraps external content in unique boundaries, datamarking interleaves a special token through every whitespace of the untrusted span, and encoding such as base64 further separates it from the instruction channel. It is a cheap first line of defense against indirect prompt injection but degrades under adaptive attack, so it should be paired with layered defenses.
In 30 seconds
- What
- Wraps untrusted external text in unique delimiters, interleaves special tokens through whitespace, or encodes it (base64) to make it visually distinct from trusted instructions.
- When to use
- Handling external content (web pages, user uploads, API responses) that could contain hidden injection attempts targeting the model.
- Watch out
- Adaptive attackers can learn your markers and work around them; treat this as a first layer only, not a complete defense.
Ask the AI expert about this pattern
Opens the assistant with your question prefilled. You review it before sending.
Spotlighting & Data Marking: Overview
A family of low-cost transformations that make untrusted external text reliably distinguishable from trusted instructions. Delimiting wraps external content in unique boundaries, datamarking interleaves a special token through every whitespace of the untrusted span, and encoding such as base64 further separates it from the instruction channel. It is a cheap first line of defense against indirect prompt injection but degrades under adaptive attack, so it should be paired with layered defenses.
- Delimiting marks the start and end of untrusted spans
- Datamarking interleaves a special token across untrusted text
- Encoding (base64/rot13) moves data off the instruction channel
- Model learns to treat marked spans as data, not commands
- Very low latency and token overhead
- Reduces indirect injection but not adaptive-attack proof
The Agent Architect
One pattern, one tradeoff, one production failure story. A short weekly briefing for people building agentic systems.
Weekly email, one-click unsubscribe. We only use your address to send the briefing.
References
The papers, specifications, and repositories this pattern is based on.
From the engineer behind this catalog
Get your agent system red-teamed
The controls described here only hold if somebody tries to break them. Have yours tested the way a real attacker would: prompt injection, jailbreaks, tool misuse and data exfiltration, every finding written up next to its fix.
€750 instead of €1,500, one week, written report and walkthrough call, until 30 September