Designing an eval harness for prompt-injection detection: what measuring my defenses actually taught me

Automated excerpt

My testbed covers five attack classes (indirect injection, tool poisoning, system-prompt leakage, the lethal trifecta, RAG data poisoning) and four defenses (instruction hierarchy, tool allow-listing, a dual-LLM guard, output sandboxing). That's the over-hardening cost, reported alongside attack success. Same golden set, same order, temperature=0, fixed seed — every defense run is directly comparable.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.