Engineer prompt-injection defense in five independent layers — make attacks expensive, don't chase a perfect filter

TokenMix·medium signal

A 2026 head-to-head ranks eight prompt-injection defenses by tested effectiveness, and the strategic framing is the takeaway: you cannot prevent all injection, so engineer to make attacks expensive enough that your threat model stops caring. Combine five independent layers — request sanitization with strict user/content separation, output filtering of instruction-like phrases, capability-scoped access, context isolation, and rate limiting — because each closes a different vector and no single layer holds. Defense-in-depth beats betting on one clever filter.