Learn defence measures that can be taken against attacks like prompt injections and jailbreaking.
Press enter or click to view image in full size
Learning Objectives
Understand why LLM security is fundamentally probabilistic, and why this means no single defence can fully prevent attacks.
Recognise how system prompt hardening raises the bar against prompt injection, and what its limits are.
Understand how input and output guardrails work, where they fail, and the trade-offs involved in deploying them.
Identify how deployment controls and least privilege reduce the damage when attacks succeed.
Understand why defence-in-depth is the only realistic approach to LLM security.
Answer the questions below
What term describes the security philosophy of stacking multiple controls so that breaking one still leaves an attacker facing others?
Defence-in-depth
What role field value should developer instructions always be placed under in structured prompt templates?
System
What should never be stored inside a system prompt?
Sensitive data
What is the term for limiting a model strictly to its intended purpose in a system prompt?
Tight Scoping
Which system prompt hardening pattern directly addresses roleplay and persona-based bypass attempts?
Persona Restriction
What type of guardrail uses string matching and regex patterns to reject requests based on known attack phrases?
Blocklist
What type of guardrail runs before the model receives the user’s prompt?
Input guardrail
What BERT-based classifier developed by Meta is used as an AI-powered input guardrail?
Llama Prompt Guard 2
What foundational security principle states that every component should have only the permissions it needs to perform its job?
Principle of least privilege
What is the OWASP identifier for the vulnerability caused by unsanitised LLM output being passed to downstream systems?
LLM05:2025
What classic web vulnerability can result from LLM-generated JavaScript being rendered in a browser without sanitisation?
XSS
Can you get the flag?
Press enter or click to view image in full size
THM{fbu349b3u4b934byr93b}
Conclusion
Get Ryca’s stories in your inbox
Join Medium for free to get updates from this writer.
This room has established that while there is no silver bullet for attacks like prompt injection, there are measures you can take to ensure these attacks are significantly less likely to succeed through an in-depth, layered approach:
LLM security is probabilistic, not binary. Attacks succeed by shifting probability distributions, which means defences must be layered rather than absolute.
A hardened system prompt is the first line of defence, using tight scoping, explicit refusal instructions, and structural separation from user input, but it cannot stand alone.
Guardrails filter malicious inputs before they reach the model and catch dangerous outputs before they leave, but can be bypassed through obfuscation and indirect injection.
Deployment controls limit what a compromised model can actually do, applying least privilege to tool access, data retrieval, and permissions to shrink the blast radius of a successful attack.
Rate limiting, logging, and monitoring ensure that when attacks slip through, they are detected, investigated, and used to strengthen future defences.
