Hines and colleagues at Microsoft describe spotlighting, a family of prompt-engineering transformations (delimiting, datamarking, encoding) that signal to the model where untrusted text came from. On GPT-family models they report attack success falling from above 50% to under 2% with minimal task impact. Microsoft later described spotlighting as one layer of its production defense-in-depth.
Why it matters
Microsoft says it uses spotlighting as one preventive layer in its own defense-in-depth against indirect prompt injection, and it is a reference case for how static-benchmark robustness can fail under adaptive attack.
Key facts
As stated in the sources, with where to find them.
- Spotlighting reduced attack success rate from greater than 50% to below 2% on GPT-family models in the authors' experiments.Abstract
- Microsoft's July 2025 MSRC post lists spotlighting (delimiting, datamarking, encoding modes) alongside Prompt Shields, data governance, deterministic blocking of known exfiltration channels and human approval.MSRC post, prevention section
Findings that cite this record
Key questions this bears on
- Can prompt injection against AI agents be reliably defended?Not reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.
Sources
Related records
Jun 11, 2025
May 20, 2025
Jun 10, 2025
Apr 19, 2024
Feb 9, 2024
Oct 10, 2025