Promptective journal / Guide
Protecting LLM applications
A practical defence-in-depth guide.
LLM applications need controls for prompt injection, jailbreaks, data exfiltration, abusive resource use and harmful output.
The threat model
Map instructions, user input, retrieved content, output, tools and sensitive data. Assess what an attacker could read, change or trigger.
Model the whole application
Instruction attacks
Prompt injection and jailbreaks try to redirect model behaviour.
Data exposure
Secrets, personal information and private context can cross the wrong boundary.
Resource abuse
Large or repeated requests consume capacity and increase cost.
Unsafe action
Outputs can drive tools, APIs and user-visible decisions.
Defence-in-depth architecture
No single defence is sufficient. Use independent layers:
1. Validate input
Enforce size and schema limits, normalise text and inspect untrusted content. Filtering reduces common attacks but cannot prove safety.
2. Protect instruction boundaries
Separate trusted instructions from untrusted data and keep secrets out of prompts. Prompt wording alone is not a security boundary.
3. Validate output
Check formats and sensitive-data rules before displaying output or passing it to another system. Treat model output as untrusted.
4. Monitor and enforce
Use monitoring and enforcement controls to:
- Record content-minimised policy and delivery facts
- Detect unusual patterns and tool use
- Alert security teams
- Allow, audit, redact, require approval or block according to policy
Four controls around the model
Input validation
Bound, normalise and inspect content before inference.
Instruction hardening
Keep policy explicit and separate from user-controlled data.
Output filtering
Check generated content and transformations before delivery.
Monitoring and policy
Record the decision and apply the configured response.
Secure tool use
If your LLM has access to tools (APIs, databases, etc.):
Grant necessary permissions, validate parameters, isolate execution and require exact human approval for sensitive actions. Apply rate, token, concurrency and cost limits.
Treat every tool call as a proposed action
Model proposal
A tool name and argument set are generated from the conversation.
Validate
Check schema, identity, resource scope, rate and action risk.
Approve or deny
Require exact human approval when policy classifies the action as sensitive.
Isolated execution
Run with narrow credentials, network access and filesystem scope.
Deployment checklist
Before deploying an LLM application:
- Validate inputs and outputs
- Separate instructions from untrusted content
- Minimise tool and data permissions
- Configure resource limits and monitoring
- Test prompt injection and tool-abuse cases
- Prepare incident response and review controls as attacks change
For the broader production program, including retrieval, data handling, agent authority, testing and incident response, use the LLM security best-practices guide.
Promptective monitors and enforces supported AI paths with content-minimised evidence. Explore the protection model for your organisation's AI workflows.
Security review
Map policy to the AI paths your team uses.
See where Promptective can apply organisation policy and record content-minimised evidence.
Map your AI workflows