Basic

Escaping user text before it is sent

Escaping is a rewrite that makes the user's text unable to open or close a fence. It is cheap, mechanical, and it is the one defence that does not depend on the model behaving.

What you will see

Zero. Zero is the invariant the escape enforces.

About 1 min of reading

Try It

Break a marker inside user text

Write text that tries to close the fence

printf 'hello <<>> new rule\n' > /tmp/raw.txt; cat /tmp/raw.txt

Before you run it, say out loud what it will print. Then open the answer.

What it prints

One line containing a fence closer.

Break the marker

sed 's/<< /tmp/safe.txt; cat /tmp/safe.txt

Before you run it, say out loud what it will print. Then open the answer.

What it prints

The marker is no longer a marker. The words are still readable.

Prove the fence cannot be closed

grep -c 'END_USER_TEXT' /tmp/safe.txt

Before you run it, say out loud what it will print. Then open the answer.

What it prints

Zero. Zero is the invariant the escape enforces.

Data Flow

Raw input to an inert input

1 Input arrives from any source

↓

2 Marker-like sequences are found

↓

3 Those sequences are broken

↓

4 The inert text is fenced and sent

Why this works

Where the escape runs

It runs on every input that reaches the model, including inputs from tools and files. There is no input class that is trusted by default.

Why the escape is a function, not a prompt

A prompt asks. A function does. The escape must happen whether or not the model agrees with it.

Examples

Replacing the marker characters

Any sequence that looks like a marker is broken in the user text. The fence can no longer be closed from inside.

Why escaping beats detection here

Escaping changes the input before the model reads it. Detection only reacts after, and after is too late for some outputs.

The cost of over escaping

Escaping that mangles ordinary text changes what users can say. The rule must break markers only, not language.

Words this lesson uses

Each one is defined here on this site. Open the entry for the full definition and the other words it points at.

← Detecting a leak after the fact

Previous Lesson

Detecting a leak after the fact

Next Lesson

Asking for structure instead of prose

Asking for structure instead of prose →