What does research say about: Spotlighting techniques reduce prompt injection success by 80%?

Marking user-provided text with special delimiters and encoding transformations reduced injection attack success from 56% to 11% — without any model fine-tuning. (Source: Hines et al., 'Defending Against Indirect Prompt Injection Attacks with Spotlighting', Microsoft, 2024). Spotlighting works by making user input visually and structurally distinct from system instructions, preventing the model from confusing data with commands.

Spotlighting techniques reduce prompt injection success by…

Spotlighting techniques reduce prompt injection success by 80%.

Marking user-provided text with special…Marking user-provided text with special delimiters and encoding transformations reduced injection attack success from 56% to 11% — without any model fine-tuning.

Context & Methodology

Spotlighting works by making user input visually and structurally distinct from system instructions, preventing the model from confusing data with commands.

Applies To

openaianthropicgoogle

Confidence Level

High

Implementation Effort

medium

Recommendation

Execution Priority

Put This Evidence to Work

Use the STCO framework to implement findings like this in structured, testable prompts.

Start Building Free Browse All 141 Citations

ROI Calculator Token Calculator Prompt Templates