Indirect prompt injection is the problem where an attacker hides instructions inside content a language model is asked to read — a web page, a document, an email — and the model follows them as if they came from the user. Existing defences mostly treat this as a yes-or-no classification problem, which fails badly on borderline content.
My framework takes a different approach: six layers of defence in depth, with a continuous risk score between zero and one rather than a binary verdict. Content passes through instruction-data separation, context sanitisation, a multilingual risk classifier, controlled-access model processing, output validation, and an adaptive feedback loop that learns from what got through.
The multilingual part matters. Almost all published work on this problem tests English only, which leaves an obvious gap for anyone attacking an Arabic-language system. The classifier covers Arabic, English, French, and Spanish.