Prompt Injection Defense Simulator

Prompt Injection Defense

Injection rate 35%

Filter sensitivity 1.3

System-prompt priority 4.0

Attack success

–

False block rate

–

Chunks / s

–

Model state

–

How it works

Two lanes feed an LLM's context window: the user query (always trusted) and external content — retrieved documents, web pages, tool output — which an attacker can quietly seed with an injected instruction. Every external chunk carries a suspicion risk score (legitimate content scores low, injected instructions score high) that a lightweight classifier gate checks before the chunk is even allowed into context. Anything that clears the gate then has to out-compete the system prompt for the model's attention: an injected instruction phrased like a command ("ignore previous instructions…") claims extra weight unless it has been stripped by sanitization, and only wins — hijacking the output — if that weight exceeds the system prompt's priority.

risk = legit: U(0.10,0.35)   injected: U(0.55,0.95)
blocked  = risk × sensitivity > 1.0
weight   = 1                              (legit, or sanitized)
         = U(2,6)                         (injected + unsanitized wording)
hijack   = injected ∧ ¬blocked ∧ weight > systemPriority

Injection rate — the share of external chunks an attacker has seeded with a hidden instruction.
Filter sensitivity — how aggressively the classifier gate converts risk into a block; too low lets injected content straight through, too high starts blocking legitimate content too (false blocks).
System-prompt priority — how much authority the system prompt is given over content pulled in from outside; a higher value takes a larger attention weight to overturn.
Sanitize toggle — strips command-like formatting from external content before it reaches the model, capping every chunk's weight at 1 regardless of wording.

Real-world relevance: this mirrors the layered defense real LLM pipelines use — input classifiers/canaries to catch obvious attacks, content sanitization to defang command-like phrasing, and an explicit priority ordering that keeps the system prompt's instructions authoritative over anything read from untrusted data.

User query (trusted) External — legit External — injected Blocked by filter Hijack (breached shield)