Prompt Fencing: A Cryptographic Approach to Establishing Security Boundaries in Large Language Model Prompts
On the map: LLM safety and security → Prompt injection and agent security
Abstract (arXiv)
Large Language Models (LLMs) remain vulnerable to prompt injection attacks, representing the most significant security threat in production deployments. We present Prompt Fencing, a novel architectural approach that applies cryptographic authentication and data architecture principles to establish explicit security boundaries within LLM prompts. Our approach decorates prompt segments with cryptographically signed metadata including trust ratings and content types, enabling LLMs to distinguish between trusted instructions and untrusted content. While current LLMs lack native fence awareness, we demonstrate that simulated awareness through prompt instructions achieved complete prevention of injection attacks in our experiments, reducing success rates from 86.7% (260/300 successful attacks) to 0% (0/300 successful attacks) across 300 test cases with two leading LLM providers. We implement a proof-of-concept fence generation and verification pipeline with a total overhead of 0.224 seconds (0.130s for fence generation, 0.094s for validation) across 100 samples. Our approach is platform-agnostic and can be incrementally deployed as a security layer above existing LLM infrastructure, with the expectation that future models will be trained with native fence awareness for optimal security.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 2 of its 6 references that are in the map. First posted on arXiv 24 Nov 2025.
Builds on
2 of 6 references.
References · 2
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
- 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
Built on by
Citing papers per year: 2026: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2025Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs
- 2026Protecting Context and Prompts: Deterministic Security for Non-Deterministic AI
- 2026Know Thy Enemy: Securing LLMs Against Prompt Injection via Diverse Data Synthesis and Instruction-Level Chain-of-Thought Learning
- 2026LTBD: Learnable Trust-Boundary Delimiters for Prompt Injection Defense
- 2024Signed-Prompt: A New Approach to Prevent Prompt Injection Attacks Against LLM-Integrated Applications
- 2024System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective
- 2023Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models
- 2026Prompt Control-Flow Integrity: A Priority-Aware Runtime Defense Against Prompt Injection in LLM Systems