The defense-in-depth mindset

The single most important mindset in AI security is this: there is no silver bullet, so you defend in depth. The field's central vulnerability — prompt injection — is considered unsolved, and no alignment technique, guardrail, or product "solves" it. Internalizing this shapes how you approach every AI security decision.

Why prompt injection is unsolved. As Module 1 explained, LLMs process instructions and data in a single natural-language channel and cannot reliably distinguish trusted instructions from untrusted data. There is no known complete mitigation — this is the consensus of OWASP, NIST, and leading security researchers. Defenses reduce the risk; none eliminates it. Any claim that a tool or technique "solves" or makes a system "immune to" prompt injection should be treated with deep skepticism, because it contradicts the current state of the art.

What "defense-in-depth" means here: because no single control is sufficient, you layer many overlapping controls so that a failure of one doesn't compromise the whole system. For AI systems, this typically means (all covered in Module 4):

• Input filtering — screen and normalize inputs for injection/jailbreak patterns.
• Output handling — never trust model output; validate and sanitize it before it hits another system.
• Guardrail layers — classifiers that check prompts and responses against a safety policy.
• Least privilege for tools and agents — minimize what the model can do and can access, so even a successful injection has limited blast radius.
• Human-in-the-loop — require human approval for consequential or irreversible actions.

Each layer catches some attacks the others miss; together they raise the cost and lower the probability of a successful attack.

The crucial corollary — limit capability, not just try to block attacks. Since you can't reliably block every injection, a core strategy is to limit what a compromised model can do. A useful teaching frame (from security researcher Simon Willison) is the "lethal trifecta": an agent becomes dangerous for data exfiltration when it simultaneously has access to private data, exposure to untrusted content, and a way to communicate externally. Remove any one of those legs — and the exfiltration path closes, even if the injection succeeds. Designing systems so a successful attack can't do much damage is often more effective than trying to make attacks impossible.

Why this mindset matters: builders who believe a single guardrail makes them safe deploy fragile systems. Builders who assume attacks will sometimes succeed and design layered defenses with limited blast radius deploy robust ones. The realistic posture is humility: assume the model can be manipulated, and architect so that manipulation is caught by multiple layers and constrained in what it can achieve.

The mindset: there is no silver bullet in AI security — prompt injection is unsolved, and nothing "solves" it — so you defend in depth. Layer overlapping controls (input filtering, output handling, guardrails, least privilege, human oversight) so no single failure is catastrophic, and crucially, limit what a compromised model can do (the lethal-trifecta frame) rather than only trying to block attacks. Assume attacks will sometimes succeed, and architect for limited blast radius. This humble, layered posture — not faith in any one defense — is what makes AI systems genuinely secure.