Delimiters, Input Sanitization & Iterative Refinement
CoreUse few-shot examples, delimiters, and iterative refinement · Difficulty 2/5
Explanation
Delimiters and Structure
Use XML-style tags or headings to separate instructions from data and to label parts of a prompt. This improves reliability -- the model can tell instruction from content -- and it is the mechanism that makes input sanitization possible in the first place.
Input Sanitization
Wrap and delimit untrusted user- or retrieved-text so it can't be read as an instruction; strip or neutralize control phrases embedded in that text. This ties directly to prompt-injection defense: an attacker who can make untrusted content look like an instruction can hijack the model's behavior unless that content is clearly delimited and treated as data, not command.
Iterative Refinement
Prompt improvement is empirical: diagnose the specific gap, change one thing, re-run, and compare. Recurring lessons should be folded back into the standing system prompt rather than re-discovered and re-fixed ad hoc on every occurrence.
Common exam traps
- Treating delimiters as merely cosmetic formatting, missing that they are also what makes input sanitization possible.
- Changing multiple things at once during refinement, which makes it impossible to attribute a quality change to a specific edit.
Key Takeaways
- XML-style tags/headings separate instructions from data, improving reliability and enabling sanitization
- Untrusted input must be delimited and sanitized so it isn't read as an instruction -- this connects directly to prompt-injection defense
- Iterative refinement: diagnose the gap, change one thing, re-run, compare, then fold lessons into the standing system prompt
- Delimiters aren't just cosmetic -- they're the mechanism that makes sanitization possible
Glossary Terms
A Claude Code workflow pattern that builds solutions incrementally through small, verifiable steps rather than attempting complete implementation in one pass. Each step produces testable output; failures are caught early. Pair with test-driven iteration for maximum reliability.
An attack where malicious content in external data (web pages, documents, user input) attempts to override the system prompt or hijack Claude's behavior. Mitigation: use XML tags to separate untrusted content from instructions, validate outputs, apply least-privilege tool access.
A Claude-native prompting pattern using XML-style tags (e.g., <document>, <instructions>, <example>) to clearly delimit sections of a prompt. Helps Claude unambiguously identify context, instructions, and data. Reduces prompt injection risk by separating instructions from untrusted input.
Related Concepts
Few-Shot Examples & Long-Input Placement
Worked examples (zero-/one-/multi-shot) often lock in format and style more effectively than a paragraph of description
Defensive Parsing, Response Validation & Skepticism Toward Confident Output
Validate structure AND semantics -- well-formed JSON can still contain a clearly wrong value