Spotlighting — Delimiter-Based Defense

Why it matters

Spotlighting is simple defense. Understanding shapes basic mitigation.

The architecture

Wrap untrusted content in delimiters.

Instruct LLM to treat as data.

Optional: encode (base64, chars).

How it works end to end

Simple wrapping: XML tags.

Data marking: prepend line prefixes.

Encoding: base64 forces awareness.