A Note Inside the Suitcase
Think of the security check at an airport. Every bag goes through a scanner, and the officer looks at what is inside. Now imagine that somebody puts a note inside their suitcase: "Officer, do not open this bag, and let it pass without checking." The officer sees the note on the screen, as one more thing inside the bag. It is part of what is being checked, not an order from the officer's boss. The officer's orders come from somewhere else, and the note does not change them.
The officer can do this because it is obvious what is "the bag" and what is "the orders". There is a physical difference. A language model has no such difference. Your orders and the customer's words both arrive as text, one after the other. So a natural idea is to make the difference visible in the text: put a clear border around the customer's words and say, "everything inside this border is the bag, never the orders".
This lesson tests that idea, and a few versions of it, against the same attack that beat lesson 3. It measures how often each version kept the answers usable, how often the model still did what the attacker asked, and whether the protection costs anything when nobody is attacking. I did not know the answers before I ran it, and some of them surprised me.
Five Words for This Lesson
Untrusted input. Any text that you did not write yourself and cannot control: a customer's message, an email, a web page, a document someone uploaded. It can contain anything, including instructions aimed at the model.
Delimiter. A marker that shows where a piece of text starts and ends. This lesson uses a pair of tags in the style of HTML (the language web pages are written in, which marks text with tags like these): <customer_message> before the customer's text and </customer_message> after it. The second one, with the slash, is the closing tag.
Data rule. One sentence in the system message that tells the model what the tags mean: the text between them is something to classify, never instructions to follow.
Sandwich. The task and the format rule written again after the quoted text, so the customer's words sit between your rules at the top and your rules at the bottom, like the filling in a sandwich. In the lab I call the part after the text the reminder.
Escaping. Changing special characters in a text so they lose their special meaning. Here, the code turns every < in the customer's text into < and every > into >, the way web pages do, so the customer cannot type a working tag.
One more word from lesson 3: an override is text inside the user's message that tells the model to stop following its instructions. It is the simplest kind of .