I'm not sure it's that simple. The problem is you can't have the system act intelligently[0] on the data at all. If it is allowed to act intelligently on the data then it can be instructed via the data. You could probably get close by training it with a privilege/authority bit but there will always be ways to break out. As far as I am aware there are no machine learning models that generalize with 100% accuracy, in fact they are deliberately made less accurate over training data in order have better generalization[1]. So the only way to defend against prompt injection is to not allow the system to perform actions it's learned and to only act on the data in ways it was explicitly programmed. At which point, what's the point of using a LLM in the first place?
0: I'm using "intelligently" here to mean doing something the system learned to do rather than being explicitly programmed to do.
1: My knowledge could be outdated or wrong here, please correct me if so.
0: I'm using "intelligently" here to mean doing something the system learned to do rather than being explicitly programmed to do.
1: My knowledge could be outdated or wrong here, please correct me if so.