Spotlighting and Datamarking Defenses

Spotlighting is a family of prompt transformations intended to make the provenance of untrusted content more visible in a model’s text context. A 2024 Microsoft-affiliated research paper describes three variants. Delimiting brackets a document with selected markers. Datamarking inserts a marker throughout the text, in the paper’s example replacing whitespace between words. Encoding transforms the document, for example using base64, and instructs the model to interpret the encoded block as data for the assigned task. Each variant also relies on a system instruction that explains how the marked text should be treated. The paper evaluated these methods on a synthetic indirect-injection corpus and older GPT-family model versions. It reported substantially lower attack success in its experiments, including a decrease from above 50% to below 2% for selected settings. Those numbers describe the paper’s particular tasks, attacks, and models; they are not expected production rates or guarantees for current systems. The paper also found encoding could impair underlying tasks for models less capable of decoding the text. This makes per-model utility evaluation important, not optional. Microsoft Foundry documents its Spotlighting preview as a document-attack control that uses base64 transformation and is supported only for models through the Chat Completions API. The docs say this increases document tokens and can cause long inputs to exceed limits, and note a possible user-visible encoding reference. That specific service behavior differs from a generic hand-built technique. In every case, marking helps signal provenance inside a shared text channel; it does not isolate data at a hardware or permission boundary. Test attacks that know the marker, preserve ordinary task quality, and restrict tool permissions so a successful injection has limited consequences.