The Sandwich Defense for Prompts

The sandwich defense places untrusted content between an initial trusted task instruction and a closing repetition or restatement of that instruction. For example, a prompt may ask for a summary, insert an external page, and then remind the model to summarize the page rather than follow directions inside it. This is a prompt-template change: it does not modify the model, create a separate data channel, or restrict tool access. It is easy to test, but it should be treated as a heuristic rather than a security boundary.

The intuition is that the final reminder may help the model focus on the intended task after reading the untrusted passage. That does not mean models always follow the last instruction, nor that the closing reminder structurally outranks hostile text. A malicious passage may imitate trusted instructions, contain multiple directives, or exploit behavior not covered by the template. The defense can also fail if the untrusted block enters context through another route that the prompt author did not account for.

Evidence is model- and attack-dependent. A 2026 preprint tested prompt sandwiching and other prompt-level defenses against domain-camouflaged injection across three model families and three synthetic deployment domains. It found substantial variation by model, and none of the tested prompt-level defenses eliminated the threat across weaker models. The study is limited to its setup; it is evidence against assuming a universal effect, not a complete ranking for every real system. Use sandwiching only as one layer alongside explicit data handling, permission checks on tools, attack testing, and user confirmation for consequential actions. Measure both resistance and task quality before release.