Prompt Scaffolding with Sentinel Token Delimiters: Structural Injection Resistance Without Constrained Decoding

Lakera·medium signalXBlueskyLinkedInCopy link

Prompt scaffolding wraps raw user input in a four-layer guarded template—role preamble, 2–3 few-shot examples, output format schema, and an injection-resistant input block—where the input block uses sentinel tokens (XML tags like <user_input>...</user_input> or triple-quoted blocks) to prevent user text from being interpreted as instructions by the model. This structural defense reduces prompt injection success rates dramatically compared to flat system prompts because the model has been trained to treat delimited blocks as data rather than directives. The technique works without constrained decoding and is the recommended defense when deploying applications where user inputs are concatenated into prompts that also contain tool outputs or retrieved documents.