1:"$Sreact.fragment" 2:I[56271,["2545","static/chunks/c16f53c3-391a1f5a73546b11.js","2619","static/chunks/2619-eccd988d1e161df3.js","3353","static/chunks/3353-35c19838f8cf7b3b.js","7177","static/chunks/app/layout-cb4429a7e3e88a9f.js"],"ThemeProviders"] 3:I[41402,["2545","static/chunks/c16f53c3-391a1f5a73546b11.js","2619","static/chunks/2619-eccd988d1e161df3.js","3353","static/chunks/3353-35c19838f8cf7b3b.js","7177","static/chunks/app/layout-cb4429a7e3e88a9f.js"],""] 4:I[91367,["2545","static/chunks/c16f53c3-391a1f5a73546b11.js","2619","static/chunks/2619-eccd988d1e161df3.js","3353","static/chunks/3353-35c19838f8cf7b3b.js","7177","static/chunks/app/layout-cb4429a7e3e88a9f.js"],"KBarSearchProvider"] 5:I[52619,["2619","static/chunks/2619-eccd988d1e161df3.js","1356","static/chunks/1356-354ecf51aaaf5203.js","6909","static/chunks/app/blog/%5B...slug%5D/page-d416e20a09ba8ecb.js"],""] 6:I[51350,["2545","static/chunks/c16f53c3-391a1f5a73546b11.js","2619","static/chunks/2619-eccd988d1e161df3.js","3353","static/chunks/3353-35c19838f8cf7b3b.js","7177","static/chunks/app/layout-cb4429a7e3e88a9f.js"],"KBarButton"] 10:I[57150,[],""] :HL["/_next/static/css/29ff447a95e95257.css","style"] :HL["/_next/static/css/77af622156c5e021.css","style"] :HL["/_next/static/css/ddf3d904beac0ed7.css","style"] 0:{"P":null,"b":"FUTryh0Sm2lrVLTvF5oMH","p":"","c":["","blog","agent-prompt-injection-defense"],"i":false,"f":[[["",{"children":["blog",{"children":[["slug","agent-prompt-injection-defense","c"],{"children":["__PAGE__",{}]}]}]},"$undefined","$undefined",true],["",["$","$1","c",{"children":[[["$","link","0",{"rel":"stylesheet","href":"/_next/static/css/29ff447a95e95257.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}],["$","link","1",{"rel":"stylesheet","href":"/_next/static/css/77af622156c5e021.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}]],["$","html",null,{"lang":"zh-cn","className":"scroll-smooth","suppressHydrationWarning":true,"children":[["$","link",null,{"rel":"apple-touch-icon","sizes":"76x76","href":"/static/favicons/apple-touch-icon.png"}],["$","link",null,{"rel":"icon","type":"image/png","sizes":"32x32","href":"/static/favicons/favicon-32x32.png"}],["$","link",null,{"rel":"icon","type":"image/png","sizes":"16x16","href":"/static/favicons/favicon-16x16.png"}],["$","link",null,{"rel":"manifest","href":"/static/favicons/site.webmanifest"}],["$","link",null,{"rel":"mask-icon","href":"/static/favicons/safari-pinned-tab.svg","color":"#5bbad5"}],["$","meta",null,{"name":"msapplication-TileColor","content":"#4f46e5"}],["$","meta",null,{"name":"theme-color","media":"(prefers-color-scheme: light)","content":"#ffffff"}],["$","meta",null,{"name":"theme-color","media":"(prefers-color-scheme: dark)","content":"#0f172a"}],["$","link",null,{"rel":"alternate","type":"application/rss+xml","href":"/feed.xml"}],["$","body",null,{"className":"bg-white pl-[calc(100vw-100%)] text-black antialiased dark:bg-gray-950 dark:text-white","children":["$","$L2",null,{"children":[["$undefined","$undefined","$undefined",["$","$L3",null,{"async":true,"defer":true,"src":"https://analytics.umami.is/script.js"}],"$undefined","$undefined"],["$","section",null,{"className":"mx-auto max-w-3xl px-4 sm:px-6 xl:max-w-5xl xl:px-0","children":[["$","$L4",null,{"kbarConfig":{"searchDocumentsPath":"/search.json"},"children":[["$","header",null,{"className":"flex items-center w-full bg-white dark:bg-gray-950 justify-between py-10","children":[["$","$L5",null,{"className":"break-words","href":"/","aria-label":"TechLog","children":["$","div",null,{"className":"flex items-center justify-between","children":[["$","div",null,{"className":"mr-3","children":["$","svg",null,{"xmlns":"http://www.w3.org/2000/svg","xmlnsXlink":"http://www.w3.org/1999/xlink","width":53.87,"height":43.61,"viewBox":"344.564 330.278 111.737 91.218","children":[["$","defs",null,{"children":[["$","linearGradient",null,{"id":"logo_svg__b","x1":420.97,"x2":420.97,"y1":331.28,"y2":418.5,"gradientUnits":"userSpaceOnUse","children":[["$","stop",null,{"offset":"0%","style":{"stopColor":"#06b6d4","stopOpacity":1}}],["$","stop",null,{"offset":"100%","style":{"stopColor":"#67e8f9","stopOpacity":1}}]]}],["$","linearGradient",null,{"id":"logo_svg__d","x1":377.89,"x2":377.89,"y1":331.28,"y2":418.5,"gradientUnits":"userSpaceOnUse","children":[["$","stop",null,{"offset":"0%","style":{"stopColor":"#06b6d4","stopOpacity":1}}],["$","stop",null,{"offset":"100%","style":{"stopColor":"#67e8f9","stopOpacity":1}}]]}],["$","path",null,{"id":"logo_svg__a","d":"M453.3 331.28v28.57l-64.66 58.65v-30.08z"}],["$","path",null,{"id":"logo_svg__c","d":"M410.23 331.28v28.57l-64.67 58.65v-30.08z"}]]}],["$","use",null,{"xlinkHref":"#logo_svg__a","fill":"url(#logo_svg__b)"}],["$","use",null,{"xlinkHref":"#logo_svg__c","fill":"url(#logo_svg__d)"}]]}]}],["$","div",null,{"className":"hidden h-6 text-2xl font-semibold sm:block","children":"TechLog"}]]}]}],["$","div",null,{"className":"flex items-center space-x-4 leading-5 sm:-mr-6 sm:space-x-6","children":[["$","div",null,{"className":"no-scrollbar hidden max-w-40 items-center gap-x-4 overflow-x-auto sm:flex md:max-w-72 lg:max-w-96","children":[["$","$L5","博客",{"className":"hover:text-primary-500 dark:hover:text-primary-400 m-1 font-medium text-gray-900 dark:text-gray-100","href":"/blog.html","children":"博客"}],["$","$L5","标签",{"className":"hover:text-primary-500 dark:hover:text-primary-400 m-1 font-medium text-gray-900 dark:text-gray-100","href":"/tags.html","children":"标签"}],["$","$L5","项目",{"className":"hover:text-primary-500 dark:hover:text-primary-400 m-1 font-medium text-gray-900 dark:text-gray-100","href":"/projects.html","children":"项目"}],["$","$L5","关于",{"className":"hover:text-primary-500 dark:hover:text-primary-400 m-1 font-medium text-gray-900 dark:text-gray-100","href":"/about.html","children":"关于"}]]}],["$","$L6",null,{"aria-label":"Search","children":["$","svg",null,{"xmlns":"http://www.w3.org/2000/svg","fill":"none","viewBox":"0 0 24 24","strokeWidth":1.5,"stroke":"currentColor","className":"hover:text-primary-500 dark:hover:text-primary-400 h-6 w-6 text-gray-900 dark:text-gray-100","children":"$L7"}]}],"$L8","$L9"]}]]}],"$La"]}],"$Lb"]}]]}]}]]}]]}],{"children":["blog","$Lc",{"children":[["slug","agent-prompt-injection-defense","c"],"$Ld",{"children":["__PAGE__","$Le",{},null,false]},null,false]},null,false]},null,false],"$Lf",false]],"m":"$undefined","G":["$10",[]],"s":false,"S":true} 11:I[49217,["2545","static/chunks/c16f53c3-391a1f5a73546b11.js","2619","static/chunks/2619-eccd988d1e161df3.js","3353","static/chunks/3353-35c19838f8cf7b3b.js","7177","static/chunks/app/layout-cb4429a7e3e88a9f.js"],"default"] 12:I[394,["2545","static/chunks/c16f53c3-391a1f5a73546b11.js","2619","static/chunks/2619-eccd988d1e161df3.js","3353","static/chunks/3353-35c19838f8cf7b3b.js","7177","static/chunks/app/layout-cb4429a7e3e88a9f.js"],"default"] 13:I[9766,[],""] 14:I[98924,[],""] 16:I[24431,[],"OutletBoundary"] 18:I[15278,[],"AsyncMetadataOutlet"] 1a:I[24431,[],"ViewportBoundary"] 1c:I[24431,[],"MetadataBoundary"] 1d:"$Sreact.suspense" 7:["$","path",null,{"strokeLinecap":"round","strokeLinejoin":"round","d":"M21 21l-5.197-5.197m0 0A7.5 7.5 0 105.196 5.196a7.5 7.5 0 0010.607 10.607z"}] 8:["$","$L11",null,{}] 9:["$","$L12",null,{}] a:["$","main",null,{"className":"mb-auto","children":["$","$L13",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L14",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":[["$","div",null,{"className":"flex flex-col items-start justify-start md:mt-24 md:flex-row md:items-center md:justify-center md:space-x-6","children":[["$","div",null,{"className":"space-x-2 pt-6 pb-8 md:space-y-5","children":["$","h1",null,{"className":"text-6xl leading-9 font-extrabold tracking-tight text-gray-900 md:border-r-2 md:px-6 md:text-8xl md:leading-14 dark:text-gray-100","children":"404"}]}],["$","div",null,{"className":"max-w-md","children":[["$","p",null,{"className":"mb-4 text-xl leading-normal font-bold md:text-2xl","children":"Sorry we couldn't find this page."}],["$","p",null,{"className":"mb-8","children":"But dont worry, you can find plenty of other things on our homepage."}],["$","$L5",null,{"className":"focus:shadow-outline-blue inline rounded-lg border border-transparent bg-blue-600 px-4 py-2 text-sm leading-5 font-medium text-white shadow-xs transition-colors duration-150 hover:bg-blue-700 focus:outline-hidden dark:hover:bg-blue-500","href":"/","children":"Back to homepage"}]]}]]}],[]],"forbidden":"$undefined","unauthorized":"$undefined"}]}] b:["$","footer",null,{"children":["$","div",null,{"className":"mt-16 flex flex-col items-center","children":[["$","div",null,{"className":"mb-3 flex space-x-4","children":[["$","a",null,{"className":"text-sm text-gray-500 transition hover:text-gray-600","target":"_blank","rel":"noopener noreferrer","href":"mailto:birenwenmou@qq.com","children":[["$","span",null,{"className":"sr-only","children":"mail"}],["$","svg",null,{"xmlns":"http://www.w3.org/2000/svg","viewBox":"0 0 20 20","className":"hover:text-primary-500 dark:hover:text-primary-400 fill-current text-gray-700 dark:text-gray-200 h-6 w-6","children":[["$","title",null,{"children":"Mail"}],["$","path",null,{"d":"M2.003 5.884L10 9.882l7.997-3.998A2 2 0 0016 4H4a2 2 0 00-1.997 1.884z"}],["$","path",null,{"d":"M18 8.118l-8 4-8-4V14a2 2 0 002 2h12a2 2 0 002-2V8.118z"}]]}]]}],["$","a",null,{"className":"text-sm text-gray-500 transition hover:text-gray-600","target":"_blank","rel":"noopener noreferrer","href":"https://github.com/joker1point","children":[["$","span",null,{"className":"sr-only","children":"github"}],["$","svg",null,{"xmlns":"http://www.w3.org/2000/svg","viewBox":"0 0 24 24","className":"hover:text-primary-500 dark:hover:text-primary-400 fill-current text-gray-700 dark:text-gray-200 h-6 w-6","children":[["$","title",null,{"children":"GitHub"}],["$","path",null,{"d":"M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12"}]]}]]}],null,null,null,null,null,null,null,null,null]}],["$","div",null,{"className":"mb-2 flex space-x-2 text-sm text-gray-500 dark:text-gray-400","children":[["$","div",null,{"children":"眠月"}],["$","div",null,{"children":" • "}],["$","div",null,{"children":"© 2026"}],["$","div",null,{"children":" • "}],["$","$L5",null,{"className":"break-words","href":"/","children":"TechLog"}]]}],["$","div",null,{"className":"mb-8 text-sm text-gray-500 dark:text-gray-400","children":["$","a",null,{"className":"break-words","target":"_blank","rel":"noopener noreferrer","href":"https://github.com/joker1point","children":"GitHub"}]}]]}]}] c:["$","$1","c",{"children":[null,["$","$L13",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L14",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":"$undefined","forbidden":"$undefined","unauthorized":"$undefined"}]]}] d:["$","$1","c",{"children":[null,["$","$L13",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L14",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":"$undefined","forbidden":"$undefined","unauthorized":"$undefined"}]]}] e:["$","$1","c",{"children":["$L15",[["$","link","0",{"rel":"stylesheet","href":"/_next/static/css/ddf3d904beac0ed7.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}]],["$","$L16",null,{"children":["$L17",["$","$L18",null,{"promise":"$@19"}]]}]]}] f:["$","$1","h",{"children":[null,[["$","$L1a",null,{"children":"$L1b"}],null],["$","$L1c",null,{"children":["$","div",null,{"hidden":true,"children":["$","$1d",null,{"fallback":null,"children":"$L1e"}]}]}]]}] 1f:I[62088,["2619","static/chunks/2619-eccd988d1e161df3.js","1356","static/chunks/1356-354ecf51aaaf5203.js","6909","static/chunks/app/blog/%5B...slug%5D/page-d416e20a09ba8ecb.js"],"default"] 20:I[81356,["2619","static/chunks/2619-eccd988d1e161df3.js","1356","static/chunks/1356-354ecf51aaaf5203.js","6909","static/chunks/app/blog/%5B...slug%5D/page-d416e20a09ba8ecb.js"],"Image"] 15:[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"BlogPosting\",\"headline\":\"Agent 怎么防止 Prompt 注入:四层纵深防御体系\",\"datePublished\":\"2026-09-06T00:00:00.000Z\",\"dateModified\":\"2026-09-06T00:00:00.000Z\",\"description\":\"单靠 Prompt 加限制词防不住注入,正确做法是搭建「输入侧 → 模型侧 → 执行侧 → 输出侧」四层纵深防御体系,其中执行侧权限管控是最硬的底线。\",\"image\":\"/static/images/twitter-card.png\",\"url\":\"https://techlog-18328.app.workbuddy.host/blog/agent-prompt-injection-defense\",\"author\":[{\"@type\":\"Person\",\"name\":\"眠月\"}]}"}}],["$","section",null,{"className":"mx-auto max-w-3xl px-4 sm:px-6 xl:max-w-5xl xl:px-0","children":[["$","$L1f",null,{}],["$","article",null,{"children":["$","div",null,{"className":"xl:divide-y xl:divide-gray-200 xl:dark:divide-gray-700","children":[["$","header",null,{"className":"pt-6 xl:pb-6","children":["$","div",null,{"className":"space-y-1 text-center","children":[["$","dl",null,{"className":"space-y-10","children":[["$","div",null,{"children":[["$","dt",null,{"className":"sr-only","children":"Published on"}],["$","dd",null,{"className":"text-base leading-6 font-medium text-gray-500 dark:text-gray-400","children":["$","time",null,{"dateTime":"2026-09-06T00:00:00.000Z","children":"2026年9月6日星期日"}]}]]}],["$","div",null,{"children":[["$","dt",null,{"className":"sr-only","children":"Word count"}],["$","dd",null,{"className":"text-sm text-gray-400 dark:text-gray-500","children":["1,547"," 字"," · 阅读约 6 分钟"]}]]}]]}],["$","div",null,{"children":["$","h1",null,{"className":"text-3xl leading-9 font-extrabold tracking-tight text-gray-900 sm:text-4xl sm:leading-10 md:text-5xl md:leading-14 dark:text-gray-100","children":"Agent 怎么防止 Prompt 注入:四层纵深防御体系"}]}]]}]}],["$","div",null,{"className":"grid-rows-[auto_1fr] divide-y divide-gray-200 pb-8 xl:grid xl:grid-cols-4 xl:gap-x-6 xl:divide-y-0 dark:divide-gray-700","children":[["$","dl",null,{"className":"pt-6 pb-10 xl:border-b xl:border-gray-200 xl:pt-11 xl:dark:border-gray-700","children":[["$","dt",null,{"className":"sr-only","children":"Authors"}],["$","dd",null,{"children":["$","ul",null,{"className":"flex flex-wrap justify-center gap-4 sm:space-x-12 xl:block xl:space-y-8 xl:space-x-0","children":[["$","li","眠月",{"className":"flex items-center space-x-2","children":[["$","$L20",null,{"src":"/static/images/avatar.png","width":38,"height":38,"alt":"avatar","className":"h-10 w-10 rounded-full"}],["$","dl",null,{"className":"text-sm leading-5 font-medium whitespace-nowrap","children":[["$","dt",null,{"className":"sr-only","children":"Name"}],["$","dd",null,{"className":"text-gray-900 dark:text-gray-100","children":"眠月"}],["$","dt",null,{"className":"sr-only","children":"Twitter"}],["$","dd",null,{"children":""}]]}]]}]]}]}]]}],["$","div",null,{"className":"divide-y divide-gray-200 xl:col-span-3 xl:row-span-2 xl:pb-0 dark:divide-gray-700","children":[["$","div",null,{"className":"prose dark:prose-invert max-w-none pt-10 pb-8","children":[["$","h2",null,{"className":"content-header","id":"agent-怎么防止-prompt-注入","children":[["$","a",null,{"className":"break-words","href":"#agent-怎么防止-prompt-注入","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"content-header-link","children":["$","svg",null,{"className":"h-5 linkicon w-5","fill":"currentColor","viewBox":"0 0 20 20","xmlns":"http://www.w3.org/2000/svg","children":[["$","path",null,{"d":"M12.232 4.232a2.5 2.5 0 0 1 3.536 3.536l-1.225 1.224a.75.75 0 0 0 1.061 1.06l1.224-1.224a4 4 0 0 0-5.656-5.656l-3 3a4 4 0 0 0 .225 5.865.75.75 0 0 0 .977-1.138 2.5 2.5 0 0 1-.142-3.667l3-3Z"}],["$","path",null,{"d":"M11.603 7.963a.75.75 0 0 0-.977 1.138 2.5 2.5 0 0 1 .142 3.667l-3 3a2.5 2.5 0 0 1-3.536-3.536l1.225-1.224a.75.75 0 0 0-1.061-1.06l-1.224 1.224a4 4 0 1 0 5.656 5.656l3-3a4 4 0 0 0-.225-5.865Z"}]]}]}]}],"Agent 怎么防止 Prompt 注入"]}],["$","p",null,{"children":[["$","strong",null,{"children":"一句话结论"}],":单靠 Prompt 加限制词防不住注入,正确做法是搭建「输入侧 → 模型侧 → 执行侧 → 输出侧」四层纵深防御体系,其中执行侧权限管控是最硬的底线。"]}],["$","blockquote",null,{"children":["$","p",null,{"children":["视频来源:",["$","a",null,{"className":"break-words","target":"_blank","rel":"noopener noreferrer","href":"https://www.bilibili.com/video/BV13YGA6hEdX/","children":"B站 - 面试官问:Agent怎么防止Prompt注入?"}]]}]}],"$L21","$L22","$L23","$L24","$L25","$L26","$L27","$L28","$L29","$L2a","$L2b","$L2c","$L2d","$L2e","$L2f","$L30","$L31","$L32","$L33","$L34","$L35","$L36","$L37","$L38","$L39","$L3a","$L3b","$L3c","$L3d","$L3e","$L3f","$L40"]}],"$L41","$L42"]}],"$L43"]}]]}]}]]}]] 44:I[50528,["2619","static/chunks/2619-eccd988d1e161df3.js","1356","static/chunks/1356-354ecf51aaaf5203.js","6909","static/chunks/app/blog/%5B...slug%5D/page-d416e20a09ba8ecb.js"],"default"] 21:["$","hr",null,{}] 22:["$","h2",null,{"className":"content-header","id":"一要做什么四层纵深防御体系总览","children":[["$","a",null,{"className":"break-words","href":"#一要做什么四层纵深防御体系总览","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"content-header-link","children":["$","svg",null,{"className":"h-5 linkicon w-5","fill":"currentColor","viewBox":"0 0 20 20","xmlns":"http://www.w3.org/2000/svg","children":[["$","path",null,{"d":"M12.232 4.232a2.5 2.5 0 0 1 3.536 3.536l-1.225 1.224a.75.75 0 0 0 1.061 1.06l1.224-1.224a4 4 0 0 0-5.656-5.656l-3 3a4 4 0 0 0 .225 5.865.75.75 0 0 0 .977-1.138 2.5 2.5 0 0 1-.142-3.667l3-3Z"}],["$","path",null,{"d":"M11.603 7.963a.75.75 0 0 0-.977 1.138 2.5 2.5 0 0 1 .142 3.667l-3 3a2.5 2.5 0 0 1-3.536-3.536l1.225-1.224a.75.75 0 0 0-1.061-1.06l-1.224 1.224a4 4 0 1 0 5.656 5.656l3-3a4 4 0 0 0-.225-5.865Z"}]]}]}]}],"一、要做什么:四层纵深防御体系总览"]}] 23:["$","p",null,{"children":["核心思路不是堵住一个点,而是多层防线叠加:",["$","strong",null,{"children":"抬高攻击成本,控制单点失守后的破坏范围。"}]]}] 24:["$","div",null,{"className":"w-full overflow-x-auto","children":["$","table",null,{"children":[["$","thead",null,{"children":["$","tr",null,{"children":[["$","th",null,{"children":"层级"}],["$","th",null,{"children":"目标"}],["$","th",null,{"children":"防御性质"}]]}]}],["$","tbody",null,{"children":[["$","tr",null,{"children":[["$","td",null,{"children":"第一层·输入侧"}],["$","td",null,{"children":"恶意内容进模型前先过滤"}],["$","td",null,{"children":"概率性防御"}]]}],["$","tr",null,{"children":[["$","td",null,{"children":"第二层·模型侧"}],["$","td",null,{"children":"提升模型自身鲁棒性"}],["$","td",null,{"children":"概率性防御"}]]}],["$","tr",null,{"children":[["$","td",null,{"children":"第三层·执行侧"}],["$","td",null,{"children":"权限管控,注入成功也无法破坏"}],["$","td",null,{"children":["$","strong",null,{"children":"确定性硬约束(最关键)"}]}]]}],["$","tr",null,{"children":[["$","td",null,{"children":"第四层·输出侧"}],["$","td",null,{"children":"防敏感泄露 + 全链路可追溯"}],["$","td",null,{"children":"兜底保障"}]]}]]}]]}]}] 25:["$","hr",null,{}] 26:["$","h2",null,{"className":"content-header","id":"二怎么做各层具体落地手段","children":[["$","a",null,{"className":"break-words","href":"#二怎么做各层具体落地手段","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"content-header-link","children":["$","svg",null,{"className":"h-5 linkicon w-5","fill":"currentColor","viewBox":"0 0 20 20","xmlns":"http://www.w3.org/2000/svg","children":[["$","path",null,{"d":"M12.232 4.232a2.5 2.5 0 0 1 3.536 3.536l-1.225 1.224a.75.75 0 0 0 1.061 1.06l1.224-1.224a4 4 0 0 0-5.656-5.656l-3 3a4 4 0 0 0 .225 5.865.75.75 0 0 0 .977-1.138 2.5 2.5 0 0 1-.142-3.667l3-3Z"}],["$","path",null,{"d":"M11.603 7.963a.75.75 0 0 0-.977 1.138 2.5 2.5 0 0 1 .142 3.667l-3 3a2.5 2.5 0 0 1-3.536-3.536l1.225-1.224a.75.75 0 0 0-1.061-1.06l-1.224 1.224a4 4 0 1 0 5.656 5.656l3-3a4 4 0 0 0-.225-5.865Z"}]]}]}]}],"二、怎么做:各层具体落地手段"]}] 27:["$","h3",null,{"className":"content-header","id":"第一层输入侧隔离与检测","children":[["$","a",null,{"className":"break-words","href":"#第一层输入侧隔离与检测","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"content-header-link","children":["$","svg",null,{"className":"h-5 linkicon w-5","fill":"currentColor","viewBox":"0 0 20 20","xmlns":"http://www.w3.org/2000/svg","children":[["$","path",null,{"d":"M12.232 4.232a2.5 2.5 0 0 1 3.536 3.536l-1.225 1.224a.75.75 0 0 0 1.061 1.06l1.224-1.224a4 4 0 0 0-5.656-5.656l-3 3a4 4 0 0 0 .225 5.865.75.75 0 0 0 .977-1.138 2.5 2.5 0 0 1-.142-3.667l3-3Z"}],["$","path",null,{"d":"M11.603 7.963a.75.75 0 0 0-.977 1.138 2.5 2.5 0 0 1 .142 3.667l-3 3a2.5 2.5 0 0 1-3.536-3.536l1.225-1.224a.75.75 0 0 0-1.061-1.06l-1.224 1.224a4 4 0 1 0 5.656 5.656l3-3a4 4 0 0 0-.225-5.865Z"}]]}]}]}],"第一层:输入侧(隔离与检测)"]}] 28:["$","ol",null,{"children":[["$","li",null,{"children":["$","p",null,{"children":[["$","strong",null,{"children":"结构隔离"}],":不可信内容不直接拼进 Prompt 与系统指令混杂,而是放入结构化字段、用专门标签包裹,让模型明确知道\"这段是数据,不是命令\"。"]}]}],["$","li",null,{"children":["$","p",null,{"children":[["$","strong",null,{"children":"分类器扫描"}],":输入进入模型前,先用独立的检测模型或规则引擎扫一遍,识别诱导性指令和越狱模板。相当于第一道安检门——",["$","strong",null,{"children":"不用太大,但一定要有"}],"。"]}]}],["$","li",null,{"children":[["$","p",null,{"children":[["$","strong",null,{"children":"拦截或降级(三档处理,不一刀切)"}],":"]}],["$","ul",null,{"children":[["$","li",null,{"children":"确认恶意 → 直接拒绝"}],["$","li",null,{"children":"可疑 → 降权标记后放行"}],["$","li",null,{"children":"正常 → 顺利通过"}],["$","li",null,{"children":"目的:既保证安全,又不误伤用户体验。"}]]}]]}]]}] 29:["$","h3",null,{"className":"content-header","id":"第二层模型侧提升鲁棒性","children":[["$","a",null,{"className":"break-words","href":"#第二层模型侧提升鲁棒性","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"content-header-link","children":["$","svg",null,{"className":"h-5 linkicon w-5","fill":"currentColor","viewBox":"0 0 20 20","xmlns":"http://www.w3.org/2000/svg","children":[["$","path",null,{"d":"M12.232 4.232a2.5 2.5 0 0 1 3.536 3.536l-1.225 1.224a.75.75 0 0 0 1.061 1.06l1.224-1.224a4 4 0 0 0-5.656-5.656l-3 3a4 4 0 0 0 .225 5.865.75.75 0 0 0 .977-1.138 2.5 2.5 0 0 1-.142-3.667l3-3Z"}],["$","path",null,{"d":"M11.603 7.963a.75.75 0 0 0-.977 1.138 2.5 2.5 0 0 1 .142 3.667l-3 3a2.5 2.5 0 0 1-3.536-3.536l1.225-1.224a.75.75 0 0 0-1.061-1.06l-1.224 1.224a4 4 0 1 0 5.656 5.656l3-3a4 4 0 0 0-.225-5.865Z"}]]}]}]}],"第二层:模型侧(提升鲁棒性)"]}] 2a:["$","ol",null,{"children":[["$","li",null,{"children":["$","p",null,{"children":[["$","strong",null,{"children":"对抗训练"}],":微调阶段往训练数据里大量混入 Prompt 注入攻击样本,全部标注为\"拒绝执行\",让模型在",["$","strong",null,{"children":"权重层面"}],"学会\"看到这种套路直接说不\"。"]}]}],["$","li",null,{"children":["$","p",null,{"children":[["$","strong",null,{"children":"指令优先级"}],":训练模型理解层级概念——",["$","strong",null,{"children":"系统级指令 > 工具返回数据 > 用户输入"}],"。即使用户输入带命令语气,模型也知道这段优先级低,不听。"]}]}],["$","li",null,{"children":["$","p",null,{"children":[["$","strong",null,{"children":"二次确认"}],":表达敏感操作之前,让模型先复述一遍——\"我理解你要做的是某某操作,确认吗?\"作用是",["$","strong",null,{"children":"打断攻击者一句话直达执行的节奏"}],"。"]}]}]]}] 2b:["$","h3",null,{"className":"content-header","id":"第三层执行侧权限管控最硬防线","children":[["$","a",null,{"className":"break-words","href":"#第三层执行侧权限管控最硬防线","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"content-header-link","children":["$","svg",null,{"className":"h-5 linkicon w-5","fill":"currentColor","viewBox":"0 0 20 20","xmlns":"http://www.w3.org/2000/svg","children":[["$","path",null,{"d":"M12.232 4.232a2.5 2.5 0 0 1 3.536 3.536l-1.225 1.224a.75.75 0 0 0 1.061 1.06l1.224-1.224a4 4 0 0 0-5.656-5.656l-3 3a4 4 0 0 0 .225 5.865.75.75 0 0 0 .977-1.138 2.5 2.5 0 0 1-.142-3.667l3-3Z"}],["$","path",null,{"d":"M11.603 7.963a.75.75 0 0 0-.977 1.138 2.5 2.5 0 0 1 .142 3.667l-3 3a2.5 2.5 0 0 1-3.536-3.536l1.225-1.224a.75.75 0 0 0-1.061-1.06l-1.224 1.224a4 4 0 1 0 5.656 5.656l3-3a4 4 0 0 0-.225-5.865Z"}]]}]}]}],"第三层:执行侧(权限管控,最硬防线)"]}] 2c:["$","ol",null,{"children":[["$","li",null,{"children":["$","p",null,{"children":[["$","strong",null,{"children":"最小权限原则"}],":Agent 只拿完成当前任务必需的最小权限。不给管理员、不给 root、不给危险接口;",["$","strong",null,{"children":"能用只读就绝不给写"}],"。"]}]}],["$","li",null,{"children":["$","p",null,{"children":[["$","strong",null,{"children":"工具白名单"}],":能调什么工具、能传什么参数,全部经过白名单校验。",["$","strong",null,{"children":"不是模型说调什么就调什么"}],",每一次调用都要过检查。"]}]}],["$","li",null,{"children":["$","p",null,{"children":[["$","strong",null,{"children":"高风险人工确认(Human-in-the-loop)"}],":删除、支付、群发邮件、执行系统命令等操作,必须弹窗由人点击同意后才真正执行。代价是体验略降,但安全性是",["$","strong",null,{"children":"质的飞跃"}],"。"]}]}],["$","li",null,{"children":["$","p",null,{"children":[["$","strong",null,{"children":"沙箱 + 读写分离"}],":敏感操作放隔离沙箱里跑;读操作和写操作用不同的凭据和通道,写操作走更严格的审批流程。"]}]}]]}] 2d:["$","h3",null,{"className":"content-header","id":"第四层输出侧过滤与追溯","children":[["$","a",null,{"className":"break-words","href":"#第四层输出侧过滤与追溯","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"content-header-link","children":["$","svg",null,{"className":"h-5 linkicon w-5","fill":"currentColor","viewBox":"0 0 20 20","xmlns":"http://www.w3.org/2000/svg","children":[["$","path",null,{"d":"M12.232 4.232a2.5 2.5 0 0 1 3.536 3.536l-1.225 1.224a.75.75 0 0 0 1.061 1.06l1.224-1.224a4 4 0 0 0-5.656-5.656l-3 3a4 4 0 0 0 .225 5.865.75.75 0 0 0 .977-1.138 2.5 2.5 0 0 1-.142-3.667l3-3Z"}],["$","path",null,{"d":"M11.603 7.963a.75.75 0 0 0-.977 1.138 2.5 2.5 0 0 1 .142 3.667l-3 3a2.5 2.5 0 0 1-3.536-3.536l1.225-1.224a.75.75 0 0 0-1.061-1.06l-1.224 1.224a4 4 0 1 0 5.656 5.656l3-3a4 4 0 0 0-.225-5.865Z"}]]}]}]}],"第四层:输出侧(过滤与追溯)"]}] 2e:["$","ol",null,{"children":[["$","li",null,{"children":["$","p",null,{"children":[["$","strong",null,{"children":"输出内容过滤"}],":模型生成内容返回用户之前再扫描一次,过滤可能夹带的",["$","strong",null,{"children":"密钥、内部 IP、个人隐私信息"}],"。"]}]}],["$","li",null,{"children":["$","p",null,{"children":[["$","strong",null,{"children":"全链路日志"}],":从用户输入 → 分类器判决 → 模型推理 → 每一步工具调用详情与返回,全链路记录、每步留痕,形成完整审计链。"]}]}],["$","li",null,{"children":["$","p",null,{"children":[["$","strong",null,{"children":"异常可观测"}],":建立实时监控,一旦出现高频工具调用、异常参数模式,",["$","strong",null,{"children":"立刻告警"}],"——在攻击进行中发现它,而不是事后翻日志才知道。"]}]}]]}] 2f:["$","hr",null,{}] 30:["$","h2",null,{"className":"content-header","id":"三为什么根因与底层逻辑","children":[["$","a",null,{"className":"break-words","href":"#三为什么根因与底层逻辑","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"content-header-link","children":["$","svg",null,{"className":"h-5 linkicon w-5","fill":"currentColor","viewBox":"0 0 20 20","xmlns":"http://www.w3.org/2000/svg","children":[["$","path",null,{"d":"M12.232 4.232a2.5 2.5 0 0 1 3.536 3.536l-1.225 1.224a.75.75 0 0 0 1.061 1.06l1.224-1.224a4 4 0 0 0-5.656-5.656l-3 3a4 4 0 0 0 .225 5.865.75.75 0 0 0 .977-1.138 2.5 2.5 0 0 1-.142-3.667l3-3Z"}],["$","path",null,{"d":"M11.603 7.963a.75.75 0 0 0-.977 1.138 2.5 2.5 0 0 1 .142 3.667l-3 3a2.5 2.5 0 0 1-3.536-3.536l1.225-1.224a.75.75 0 0 0-1.061-1.06l-1.224 1.224a4 4 0 1 0 5.656 5.656l3-3a4 4 0 0 0-.225-5.865Z"}]]}]}]}],"三、为什么:根因与底层逻辑"]}] 31:["$","h3",null,{"className":"content-header","id":"prompt-注入的根因","children":[["$","a",null,{"className":"break-words","href":"#prompt-注入的根因","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"content-header-link","children":["$","svg",null,{"className":"h-5 linkicon w-5","fill":"currentColor","viewBox":"0 0 20 20","xmlns":"http://www.w3.org/2000/svg","children":[["$","path",null,{"d":"M12.232 4.232a2.5 2.5 0 0 1 3.536 3.536l-1.225 1.224a.75.75 0 0 0 1.061 1.06l1.224-1.224a4 4 0 0 0-5.656-5.656l-3 3a4 4 0 0 0 .225 5.865.75.75 0 0 0 .977-1.138 2.5 2.5 0 0 1-.142-3.667l3-3Z"}],["$","path",null,{"d":"M11.603 7.963a.75.75 0 0 0-.977 1.138 2.5 2.5 0 0 1 .142 3.667l-3 3a2.5 2.5 0 0 1-3.536-3.536l1.225-1.224a.75.75 0 0 0-1.061-1.06l-1.224 1.224a4 4 0 1 0 5.656 5.656l3-3a4 4 0 0 0-.225-5.865Z"}]]}]}]}],"Prompt 注入的根因"]}] 32:["$","p",null,{"children":["大模型把系统指令、工具返回结果、用户消息",["$","strong",null,{"children":"全部拼成同一个 token 序列"}],",模型眼里没有任何硬件级边界,只是按概率逐个词往后接——它",["$","strong",null,{"children":"分不清哪个是命令、哪个是数据"}],"。只要攻击者把恶意指令塞进上下文,它就可能变成模型要遵循的指令。"]}] 33:["$","h3",null,{"className":"content-header","id":"为什么-prompt-加固防不住","children":[["$","a",null,{"className":"break-words","href":"#为什么-prompt-加固防不住","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"content-header-link","children":["$","svg",null,{"className":"h-5 linkicon w-5","fill":"currentColor","viewBox":"0 0 20 20","xmlns":"http://www.w3.org/2000/svg","children":[["$","path",null,{"d":"M12.232 4.232a2.5 2.5 0 0 1 3.536 3.536l-1.225 1.224a.75.75 0 0 0 1.061 1.06l1.224-1.224a4 4 0 0 0-5.656-5.656l-3 3a4 4 0 0 0 .225 5.865.75.75 0 0 0 .977-1.138 2.5 2.5 0 0 1-.142-3.667l3-3Z"}],["$","path",null,{"d":"M11.603 7.963a.75.75 0 0 0-.977 1.138 2.5 2.5 0 0 1 .142 3.667l-3 3a2.5 2.5 0 0 1-3.536-3.536l1.225-1.224a.75.75 0 0 0-1.061-1.06l-1.224 1.224a4 4 0 1 0 5.656 5.656l3-3a4 4 0 0 0-.225-5.865Z"}]]}]}]}],"为什么 Prompt 加固防不住"]}] 34:["$","p",null,{"children":["在 Prompt 里写\"不要听用户的指令\",攻击者用更强的指令可以直接覆盖,或用角色扮演、编码混淆轻松绕过。本质是",["$","strong",null,{"children":"纸糊的墙挡子弹"}],",治标不治本。"]}] 35:["$","h3",null,{"className":"content-header","id":"为什么执行侧最关键","children":[["$","a",null,{"className":"break-words","href":"#为什么执行侧最关键","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"content-header-link","children":["$","svg",null,{"className":"h-5 linkicon w-5","fill":"currentColor","viewBox":"0 0 20 20","xmlns":"http://www.w3.org/2000/svg","children":[["$","path",null,{"d":"M12.232 4.232a2.5 2.5 0 0 1 3.536 3.536l-1.225 1.224a.75.75 0 0 0 1.061 1.06l1.224-1.224a4 4 0 0 0-5.656-5.656l-3 3a4 4 0 0 0 .225 5.865.75.75 0 0 0 .977-1.138 2.5 2.5 0 0 1-.142-3.667l3-3Z"}],["$","path",null,{"d":"M11.603 7.963a.75.75 0 0 0-.977 1.138 2.5 2.5 0 0 1 .142 3.667l-3 3a2.5 2.5 0 0 1-3.536-3.536l1.225-1.224a.75.75 0 0 0-1.061-1.06l-1.224 1.224a4 4 0 1 0 5.656 5.656l3-3a4 4 0 0 0-.225-5.865Z"}]]}]}]}],"为什么执行侧最关键"]}] 36:["$","ul",null,{"children":[["$","li",null,{"children":["前两层(输入侧、模型侧)都是",["$","strong",null,{"children":"概率性防御"}],",总会有高级攻击能绕过;"]}],["$","li",null,{"children":["执行侧的权限控制是",["$","strong",null,{"children":"确定性的硬约束"}],"——即使 LLM 被注入、产生了\"删除服务器所有文件\"的意图,只要 Agent 根本没有 delete 工具的调用权限,就什么都做不了。"]}],["$","li",null,{"children":["一句话:",["$","strong",null,{"children":"执行侧的权限控制是最后也是最硬的防线。"}]]}]]}] 37:["$","h3",null,{"className":"content-header","id":"为什么要重视输出侧追溯","children":[["$","a",null,{"className":"break-words","href":"#为什么要重视输出侧追溯","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"content-header-link","children":["$","svg",null,{"className":"h-5 linkicon w-5","fill":"currentColor","viewBox":"0 0 20 20","xmlns":"http://www.w3.org/2000/svg","children":[["$","path",null,{"d":"M12.232 4.232a2.5 2.5 0 0 1 3.536 3.536l-1.225 1.224a.75.75 0 0 0 1.061 1.06l1.224-1.224a4 4 0 0 0-5.656-5.656l-3 3a4 4 0 0 0 .225 5.865.75.75 0 0 0 .977-1.138 2.5 2.5 0 0 1-.142-3.667l3-3Z"}],["$","path",null,{"d":"M11.603 7.963a.75.75 0 0 0-.977 1.138 2.5 2.5 0 0 1 .142 3.667l-3 3a2.5 2.5 0 0 1-3.536-3.536l1.225-1.224a.75.75 0 0 0-1.061-1.06l-1.224 1.224a4 4 0 1 0 5.656 5.656l3-3a4 4 0 0 0-.225-5.865Z"}]]}]}]}],"为什么要重视输出侧追溯"]}] 38:["$","p",null,{"children":["你不可能防住所有攻击,但你必须知道",["$","strong",null,{"children":"被攻击了、攻击者做了什么"}],"。安全事件的可追溯性,有时候比预防本身更重要。"]}] 39:["$","hr",null,{}] 3a:["$","h2",null,{"className":"content-header","id":"四面试回答框架可直接套用","children":[["$","a",null,{"className":"break-words","href":"#四面试回答框架可直接套用","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"content-header-link","children":["$","svg",null,{"className":"h-5 linkicon w-5","fill":"currentColor","viewBox":"0 0 20 20","xmlns":"http://www.w3.org/2000/svg","children":[["$","path",null,{"d":"M12.232 4.232a2.5 2.5 0 0 1 3.536 3.536l-1.225 1.224a.75.75 0 0 0 1.061 1.06l1.224-1.224a4 4 0 0 0-5.656-5.656l-3 3a4 4 0 0 0 .225 5.865.75.75 0 0 0 .977-1.138 2.5 2.5 0 0 1-.142-3.667l3-3Z"}],["$","path",null,{"d":"M11.603 7.963a.75.75 0 0 0-.977 1.138 2.5 2.5 0 0 1 .142 3.667l-3 3a2.5 2.5 0 0 1-3.536-3.536l1.225-1.224a.75.75 0 0 0-1.061-1.06l-1.224 1.224a4 4 0 1 0 5.656 5.656l3-3a4 4 0 0 0-.225-5.865Z"}]]}]}]}],"四、面试回答框架(可直接套用)"]}] 3b:["$","ol",null,{"children":[["$","li",null,{"children":["$","p",null,{"children":[["$","strong",null,{"children":"先点根因"}],":Prompt 注入的本质是大模型无法从架构上区分指令和数据——系统指令和用户输入在模型里都是 token,没有天然边界,所以单靠 Prompt 加限制词治标不治本。"]}]}],["$","li",null,{"children":["$","p",null,{"children":[["$","strong",null,{"children":"再给解法"}],":纵深防御四层体系——输入侧做结构化隔离和分类检测;模型侧做对抗训练提升鲁棒性;执行侧用最小权限、白名单和人工确认做硬约束;输出侧做内容过滤和全链路审计。"]}]}],["$","li",null,{"children":["$","p",null,{"children":[["$","strong",null,{"children":"最后定调"}],":前两层降低概率,执行侧守住底线,输出侧保证可追溯。"]}]}]]}] 3c:["$","hr",null,{}] 3d:["$","p",null,{"children":["$","strong",null,{"children":"金句摘录:"}]}] 3e:["$","blockquote",null,{"children":["$","p",null,{"children":"\"用 Prompt 防 Prompt 注入,就是纸糊的墙挡子弹。\""}]}] 3f:["$","blockquote",null,{"children":["$","p",null,{"children":"\"即使注入成功了,没有权限就什么都做不了。\""}]}] 40:["$","blockquote",null,{"children":["$","p",null,{"children":"\"可追溯性有时候比预防本身更重要。\""}]}] 41:["$","div",null,{"className":"pt-6 pb-6 text-sm text-gray-700 dark:text-gray-300","children":[["$","a",null,{"className":"break-words","target":"_blank","rel":"nofollow","href":"https://mobile.twitter.com/search?q=https%3A%2F%2Ftechlog-18328.app.workbuddy.host%2Fblog%2Fagent-prompt-injection-defense","children":"Discuss on Twitter"}]," • ",["$","a",null,{"className":"break-words","target":"_blank","rel":"noopener noreferrer","href":"https://github.com/joker1point/techlog/blob/main/data/blog/agent-prompt-injection-defense.mdx","children":"View on GitHub"}]]}] 42:["$","div",null,{"className":"pt-6 pb-6 text-center text-gray-700 dark:text-gray-300","id":"comment","children":["$","$L44",null,{"slug":"agent-prompt-injection-defense"}]}] 43:["$","footer",null,{"children":[["$","div",null,{"className":"divide-gray-200 text-sm leading-5 font-medium xl:col-start-1 xl:row-start-2 xl:divide-y dark:divide-gray-700","children":[["$","div",null,{"className":"py-4 xl:py-8","children":[["$","h2",null,{"className":"text-xs tracking-wide text-gray-500 uppercase dark:text-gray-400","children":"Tags"}],["$","div",null,{"className":"flex flex-wrap","children":[["$","$L5","ai",{"className":"text-primary-500 hover:text-primary-600 dark:hover:text-primary-400 mr-3 text-sm font-medium uppercase","href":"/tags/ai.html","children":"ai"}],["$","$L5","agent",{"className":"text-primary-500 hover:text-primary-600 dark:hover:text-primary-400 mr-3 text-sm font-medium uppercase","href":"/tags/agent.html","children":"agent"}],["$","$L5","security",{"className":"text-primary-500 hover:text-primary-600 dark:hover:text-primary-400 mr-3 text-sm font-medium uppercase","href":"/tags/security.html","children":"security"}],["$","$L5","prompt-injection",{"className":"text-primary-500 hover:text-primary-600 dark:hover:text-primary-400 mr-3 text-sm font-medium uppercase","href":"/tags/prompt-injection.html","children":"prompt-injection"}],["$","$L5","llm",{"className":"text-primary-500 hover:text-primary-600 dark:hover:text-primary-400 mr-3 text-sm font-medium uppercase","href":"/tags/llm.html","children":"llm"}]]}]]}],["$","div",null,{"className":"flex justify-between py-4 xl:block xl:space-y-8 xl:py-8","children":[["$","div",null,{"children":[["$","h2",null,{"className":"text-xs tracking-wide text-gray-500 uppercase dark:text-gray-400","children":"Previous Article"}],["$","div",null,{"className":"text-primary-500 hover:text-primary-600 dark:hover:text-primary-400","children":["$","$L5",null,{"className":"break-words","href":"/blog/agent-skill-governance.html","children":"我是如何保证 Agent Skill 多而不乱的?"}]}]]}],["$","div",null,{"children":[["$","h2",null,{"className":"text-xs tracking-wide text-gray-500 uppercase dark:text-gray-400","children":"Next Article"}],["$","div",null,{"className":"text-primary-500 hover:text-primary-600 dark:hover:text-primary-400","children":["$","$L5",null,{"className":"break-words","href":"/blog/agent-lessons-precipitation.html","children":"如何沉淀 Agent 每次的踩坑经验"}]}]]}]]}]]}],["$","div",null,{"className":"pt-4 xl:pt-8","children":["$","$L5",null,{"className":"text-primary-500 hover:text-primary-600 dark:hover:text-primary-400","href":"/blog.html","aria-label":"Back to the blog","children":"← Back to the blog"}]}]]}] 1b:[["$","meta","0",{"charSet":"utf-8"}],["$","meta","1",{"name":"viewport","content":"width=device-width, initial-scale=1"}]] 17:null 19:{"metadata":[["$","title","0",{"children":"Agent 怎么防止 Prompt 注入:四层纵深防御体系 | TechLog"}],["$","meta","1",{"name":"description","content":"单靠 Prompt 加限制词防不住注入,正确做法是搭建「输入侧 → 模型侧 → 执行侧 → 输出侧」四层纵深防御体系,其中执行侧权限管控是最硬的底线。"}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","meta","3",{"name":"googlebot","content":"index, follow, max-video-preview:-1, max-image-preview:large, max-snippet:-1"}],["$","link","4",{"rel":"canonical","href":"https://techlog-18328.app.workbuddy.host/blog/agent-prompt-injection-defense"}],["$","link","5",{"rel":"alternate","type":"application/rss+xml","href":"https://techlog-18328.app.workbuddy.host/feed.xml"}],["$","meta","6",{"property":"og:title","content":"Agent 怎么防止 Prompt 注入:四层纵深防御体系"}],["$","meta","7",{"property":"og:description","content":"单靠 Prompt 加限制词防不住注入,正确做法是搭建「输入侧 → 模型侧 → 执行侧 → 输出侧」四层纵深防御体系,其中执行侧权限管控是最硬的底线。"}],["$","meta","8",{"property":"og:url","content":"https://techlog-18328.app.workbuddy.host/blog/agent-prompt-injection-defense"}],["$","meta","9",{"property":"og:site_name","content":"TechLog"}],["$","meta","10",{"property":"og:locale","content":"en_US"}],["$","meta","11",{"property":"og:image","content":"https://techlog-18328.app.workbuddy.host/static/images/twitter-card.png"}],["$","meta","12",{"property":"og:type","content":"article"}],["$","meta","13",{"property":"article:published_time","content":"2026-09-06T00:00:00.000Z"}],["$","meta","14",{"property":"article:modified_time","content":"2026-09-06T00:00:00.000Z"}],["$","meta","15",{"property":"article:author","content":"眠月"}],["$","meta","16",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","17",{"name":"twitter:title","content":"Agent 怎么防止 Prompt 注入:四层纵深防御体系"}],["$","meta","18",{"name":"twitter:description","content":"单靠 Prompt 加限制词防不住注入,正确做法是搭建「输入侧 → 模型侧 → 执行侧 → 输出侧」四层纵深防御体系,其中执行侧权限管控是最硬的底线。"}],["$","meta","19",{"name":"twitter:image","content":"https://techlog-18328.app.workbuddy.host/static/images/twitter-card.png"}]],"error":null,"digest":"$undefined"} 1e:"$19:metadata"