Input Filtering
Gates on the way in
Input filters gate what the model is allowed to see: disallowed topics, format limits, injection-shaped text, and size caps on the way in. Filtering before inference blocks junk cheaply — before it costs tokens or acts.
What you will learn
- Define input policies (topics, formats, sizes)
- Add injection heuristics to input filters
- Return clean rejections to users
What is this?
Input filtering applies policy before inference: wildcard ways to block disallowed topics, enforce format expectations, cap lengths, and flag injection-shaped strings ('ignore previous instructions'). Cheap and fast, it stops junk before tokens and tool calls — an allowlist-by-default posture is strongest.
Why do you need it?
- Blocking early saves tokens and prevents side effects.
- Injection-shaped inputs get caught before they influence tools.
- Size caps bound context cost and latency.
- Deterministic rules are cheap, testable, and fast.
Mental model
Checking fields at customs
Input filtering
Goods (inputs) are scanned before entering the country: prohibited items (topics), wild forms (formats), overweight crates (size caps), and suspicious passports (injection patterns). Scanning is cheaper than dealing with what got through.
How it works
- Pattern-check: disallowed topics via classifier or blocks.
- Format-check: expected structure/type validation.
- Size-check: token and length caps.
- Injection heuristics: 'ignore instructions', delimiter scams.
- Reject with a clean reason or route to a safe fallback.
Pre-inference gates.
In production
- Kids' products block topics at the boundary.
- Form-based apps enforce JSON/schema before the model sees it.
- Chat limits cap turn length for cost and safety.
Best practices
- Default-deny where policy is clear.
- Rejections should name the rule (UX-window).
- Keep classification cheap; escalate only suspicious ones.
- Tune on real traffic; reduce false positives.
Common mistakes
- Prompt-only topic control — the model not the gate decides.
- Heuristics that nuke normal messages (e.g. 'ignore' as a word).
- No caps on length — cost and context abuse.
Common issues
Injection bypasses filtersHeuristics too shallow
Layered checks + treat ALL model input as untrusted regardless of filters.
Filter blocks the product's own flowsRules too broad
Business-case exceptions with logging and review.
Debugging tips
- Legit input blocked → false positive; add context or narrow rule.
- Abuse slips through → missing layer; test adversarial traffic.
- Latency spikes → classification on the hot path too heavy; sample.
Interview checkpoint
Hands-on lab
- Block inputs carrying known bypass terms
- Strip characters outside an allowed set
- Enforce a length cap
Sanitize and Cap Input
25 min · beginner
Quick quiz
Input filters run…
Heuristics alone fully stop prompt injection.