Untrusted input

As explained in Prompt Engineering in Practice

Externally supplied material that must not be treated as authoritative instructions without additional controls.

Untrusted input is runtime text from a source you do not control, such as a user message, retrieved document, or external API response. Trust depends on control, not whether the content is malicious. section 10.1

When trusted instructions and external text run together without a boundary, the model has no mechanism for distinguishing who supplied each part. Any runtime text can influence how the prompt is interpreted; managing that interaction requires explicit steps. section 10.1

Instruction override

A user asks a chatbot to ignore its instructions and return customer names, email addresses, and shipping details. The chatbot complies, exposing customer data. The example shows how an external instruction can exploit an unbounded prompt. section 10.0

Figure 10.1 How a language model processes a prompt with no boundary between trusted and untrusted input

Use the figure to see how trusted instructions and untrusted text form one continuous prompt when no boundary separates them. section 10.1

How Prompt Engineering in Practice covers it

How deep it goes

Defines trust by control and explains how unbounded prompts let runtime text influence earlier instructions, but does not detail defenses.

Examples

Uses a request to override instructions and expose customer records, alongside user messages, retrieved documents, and API responses.

What it assumes

Assumes familiarity with system prompts, delimiters, structural boundaries, constraint precision, and separating stable instructions from variable inputs.

What you can do after

Evaluate how external text can influence prompt behavior and recognize the need to separate it from trusted instructions.

How it connects

Connects untrusted input to prompt injection, jailbreaking, instruction conflict, system prompts, delimiters, and prompt templates.

liveBookmanning.com

Read Prompt Engineering in Practice on liveBook Get the book at manning.com

Related concepts

• trusted inputcontrasts with · Trusted input is data considered sufficiently reliable or authoritative within a given trust model to use without additional validation.
• evaluses · eval is a language operation or built-in function that interprets and executes a code representation within a specified execution context.
• delimiter-based separationused by · Delimiter-based separation is a prompt-hardening technique that marks the boundaries of untrusted content so a model is less likely to interpret that content as instructions.
• authorization decisionuses · An authorization decision determines whether a principal is permitted to access a resource or perform an action under applicable permissions or policy.

This explainer was generated by Manning's knowledge graph from the text of Prompt Engineering in Practice. The section links point to the parts of the book it draws on.