Spotlighting

Spotlighting is a defence against indirect prompt injection. A language model reads one stream of text. It cannot see which part came from the user and which from an email.

How spotlighting works

Two parts work together in each mode:

1. The application changes the untrusted text before the model reads it.
2. The system prompt tells the model about the change. Microsoft also tells the model not to obey instructions in the marked text.

The three modes of the 2024 paper by Hines and colleagues:

Mode	What the application does	Example
Delimiting	Puts special tokens before and after the untrusted text	A random string at each end
Datamarking	Puts a special token between the words of all of the text	Readˆtheˆnextˆemailˆandˆreply
Encoding	Transforms all of the text with a known encoding	base64, ROT13

A delimiter marks only the two ends. Datamarking and encoding mark all parts of the text.

What spotlighting gives you

Spotlighting needs no new model and no training. In the 2024 paper:

• Attack success went from “greater than 50% to below 2%” on GPT-family models.
• The test set was 1,000 synthetic documents with “variations on a simple keyword payload attack”.

In practice

The MSRC blog of July 2025 says that spotlighting is “probabilistic”. Microsoft uses it as one layer of some. The other layers are:

• Prompt Shields, a classifier that finds injections.
• Deterministic blocking, which limits the damage when an injection gets through.
• Data governance.
• Explicit consent of the user before a step.

Prompt Shields in Microsoft Foundry has spotlighting in preview. It is off by default. The Foundry version uses base-64 encoding of documents. The documentation of Microsoft gives these costs:

• More document tokens, thus a higher total cost.
• Large documents can go above the input limit.
• It works only with models used through the Chat Completions API.
• The model can say in its answer that the document was base-64 encoded.

Trade-offs of the three modes

Mode	Result in the 2024 paper	Cost or weak point
Delimiting	Cut attack success by about half	The authors “do not recommend” it. An attacker who knows the system prompt can write the delimiter.
Datamarking	1.0% (GPT-4) to 8.0% (GPT-3.5-Turbo) on question answering	No loss of task performance. An attack string with no spaces gets around a mark on spaces.
Encoding	0.0% on summarization, 1.8% on question answering (GPT-3.5-Turbo)	GPT-3.5-Turbo did the tasks less correctly. The authors recommend it only for the strongest models.

For datamarking, the authors recommend marks at random positions and frequent changes of the mark.

What other tests found

Tests by other teams show smaller or no protection:

• AgentDojo, 2024. A delimiter defence adapted from spotlighting put marks around tool outputs. With GPT-4o, targeted attack success rate went from 57.69% to 41.65%.
• Nasr and colleagues, 2025. On AgentDojo, spotlighting held fixed attacks to “as low as 1%”. A search based adaptive attack got above 95%. Human testers made 265 attacks that worked against it.

Questions and answers

Does spotlighting stop prompt injection?

No. Spotlighting reduces the risk, but the model can obey marked text. Microsoft says that spotlighting is probabilistic. In 2025, a search based adaptive attack by Nasr and colleagues got above 95% attack success against spotlighting on AgentDojo.

Which spotlighting mode is best?

The 2024 paper does not recommend plain delimiters. An attacker who knows the system prompt can get around them. Datamarking did not make task results worse in its tests. Encoding gave the lowest attack success, but the authors recommend it only for the strongest models, such as GPT-4.

Where is spotlighting available?

Prompt Shields in Microsoft Foundry has Spotlighting in preview, for document attacks. It is off by default. It encodes documents in base-64. This adds tokens and cost, and it works only with the Chat Completions API.