{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/microsoft-spotlighting-2024/",
 "asOf": "2026-09-26",
 "id": "microsoft-spotlighting-2024",
 "date": "2024-03-20",
 "datePrecision": "day",
 "title": "Microsoft researchers propose spotlighting to mark untrusted input against indirect prompt injection",
 "lane": "defense",
 "kind": "paper",
 "summary": "Hines and colleagues at Microsoft describe spotlighting, a family of prompt-engineering transformations (delimiting, datamarking, encoding) that signal to the model where untrusted text came from. On GPT-family models they report attack success falling from above 50% to under 2% with minimal task impact. Microsoft later described spotlighting as one layer of its production defense-in-depth.",
 "whyItMatters": "Microsoft says it uses spotlighting as one preventive layer in its own defense-in-depth against indirect prompt injection, and it is a reference case for how static-benchmark robustness can fail under adaptive attack.",
 "actors": [
  "microsoft"
 ],
 "topics": [
  "prompt-injection"
 ],
 "atlas": [
  "untrusted-content",
  "model"
 ],
 "artifacts": [
  "spotlighting"
 ],
 "sources": [
  {
   "url": "https://arxiv.org/abs/2403.14720",
   "publisher": "arXiv",
   "title": "Defending Against Indirect Prompt Injection Attacks With Spotlighting",
   "date": "2024-03-20",
   "type": "primary",
   "accessed": "2026-09-25"
  },
  {
   "url": "https://www.microsoft.com/en-us/msrc/blog/2025/07/how-microsoft-defends-against-indirect-prompt-injection-attacks",
   "publisher": "Microsoft Security Response Center",
   "title": "How Microsoft defends against indirect prompt injection attacks",
   "date": "2025-07-29",
   "type": "primary",
   "accessed": "2026-09-25",
   "shared": true
  }
 ],
 "keyFacts": [
  {
   "fact": "Spotlighting reduced attack success rate from greater than 50% to below 2% on GPT-family models in the authors' experiments.",
   "locator": "Abstract"
  },
  {
   "fact": "Microsoft's July 2025 MSRC post lists spotlighting (delimiting, datamarking, encoding modes) alongside Prompt Shields, data governance, deterministic blocking of known exfiltration channels and human approval.",
   "locator": "MSRC post, prevention section"
  }
 ],
 "significance": 3,
 "fideQuestions": [],
 "methods": [
  "agent-data-exfiltration",
  "indirect-prompt-injection",
  "injection-classifiers",
  "input-delimiting"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}