A system-level approach to prompt injection: separating instruction and data channels in LLM agents [P]

Prompt injection has emerged as one of the most persistent failure modes in tool-using LLM systems, particularly in agentic workflows where models interact with external data sources. Most mitigation strategies focus on input filtering or model-side alignment, but these approaches struggle because the core issue is structural: Approach I explored a system-level mitigation strategy by introducing a middleware layer ( Sentinel Gateway ) that enforces a strict separation between: Instruction channel : trusted, runtime-issued commands Data channel : untrusted external inputs (web, files, APIs) Ins