It's not about debuggability, prompt injection is an inherent risk in current LLM architectures. It's like a coding language where strings don't have quotes, and it's up to the compiler to guess whether something is code or data.
We have to hope there's going to be an architectural breakthrough in the next couple/few years that creates a way to separate out instructions (prompts) and "data", i.e. the main conversation.
E.g. input that relies on two sets of tokens (prompt tokens and data tokens) that can never be mixed or confused with each other. Obviously we don't know how to do this yet and it will require a major architectural advance to be able to train and operate at two levels like that, but we have to hope that somebody figures it out.
There's no fundamental reason to think it's impossible. It doesn't fit into the current paradigm of a single sequence of tokens, but that's why paradigms evolve.
We have to hope there's going to be an architectural breakthrough in the next couple/few years that creates a way to separate out instructions (prompts) and "data", i.e. the main conversation.
E.g. input that relies on two sets of tokens (prompt tokens and data tokens) that can never be mixed or confused with each other. Obviously we don't know how to do this yet and it will require a major architectural advance to be able to train and operate at two levels like that, but we have to hope that somebody figures it out.
There's no fundamental reason to think it's impossible. It doesn't fit into the current paradigm of a single sequence of tokens, but that's why paradigms evolve.