Prompt Injection as a Control/Data Boundary Problem

Short summary

The article reframes prompt injection as a control/data boundary problem analogous to SQL injection. It proposes a two-channel architecture where a data plane signs untrusted content as inert data using Ed25519, and a control plane verifies signatures before allowing content to influence tool execution. This enforces separation in application code around the model call, though current LLM APIs still collapse trusted and untrusted text into one token stream.

• •Prompt injection is fundamentally a control/data boundary problem, not just a model behavior issue
• •Two-channel design uses Ed25519 signing: data plane signs, control plane verifies, preventing forgery
• •Application-level verification gates tool calls; model can read content but cannot grant it authority

Generated with AI, which can make mistakes.