You’ve probably spent weeks building the perfect input filters. You’ve written thousands of words in system prompts, begging your LLM not to listen to malicious users. You think you’re building a fortress.
You’re actually just guarding the wrong door.
The entire industry is obsessed with ingress—trying to sanitize what goes *into* the model. We think if we just write a stricter system prompt, we can block prompt injection. But this creates a paradoxical loop. You cannot use more prompts to solve a prompt injection problem. It’s like trying to put out a fire with a flamethrower. The very tool you use to defend the model is susceptible to the exact same attack.
The real damage of prompt injection isn’t what happens inside the neural network. The damage happens when data leaves the trust boundary. Prompt injection is fundamentally an egress problem.
Attackers don’t care about breaking your input filters. They care about exfiltrating your data. They exploit the model’s own language generation to silently leak your secrets, whether it’s through a hidden API call, a markdown image link, or just a cleverly phrased response.
Your AI assistant isn’t just a tool; it’s a potential insider threat with a PhD in social engineering.
If you’re building or deploying LLM applications, you need to reframe your security instincts. Stop obsessing over what the model *hears*. Start obsessing over what it *says*. The real leverage point isn’t input cleaning; it’s deterministic egress monitoring. You need to constrain and monitor the model’s outputs.
Conventional security tells us to build higher walls around the entrance. But in the age of LLMs, the entrance is a revolving door of natural language. Security isn’t about building a higher wall around the entrance. It’s about putting a muzzle on the exit.
Shift your resources to egress monitoring. Watch what leaves the trust boundary. That is the only way to stop the invisible data exfiltration that is quietly breaking your app.
FAQ
Q: But don't we still need some input filters to stop obvious attacks?
A: Sure, basic hygiene is fine. But if you're spending 90% of your security budget on ingress filtering, you're doing it wrong. Input filters are heuristic and easily bypassed by natural language variations. Focus your heavy lifting on deterministic egress controls.
Q: How do I actually monitor egress in an LLM app?
A: You don't use another LLM to check the output. You use deterministic, programmatic solutions. Scan outputs for URLs, API calls, or specific data patterns before they are rendered or executed. If the model tries to send data outside the trust boundary, block it at the code level.
Q: Is prompt injection just an unsolvable problem then?
A: It's unsolvable if you treat it as an input parsing problem. But if you reframe it as an egress problem, it becomes highly manageable. You can't control what the model thinks, but you can absolutely control what it is allowed to do.