Guardrails for LLM Apps in Java

Short summary

Untrusted text—from users, retrieved documents, or model outputs—must be isolated from instruction channels via XML-style delimiters (<customer_message>, <context>) combined with explicit system prompts that treat delimited content as data, not instructions. The post teaches three distinct injection attack vectors (direct, indirect, and output-based) and applies the same defense-in-depth delimiting pattern to each, demonstrating with production-ready Java SDK code. This is the capstone of a security-focused tutorial series on building reliable LLM applications.

• •Untrusted text must be delimited and isolated from instruction channels using XML tags and system prompt rules
• •Direct injection, indirect injection (via RAG), and model output all require the same defensive boundary pattern
• •Code examples use Anthropic's Java SDK to show safe vs. unsafe patterns applied to each attack vector

Generated with AI, which can make mistakes.