实验假设Hypothesis
单一检测器无法覆盖提示注入，防御必须同时限制模型能够触达的权限和输出通道。No single detector covers prompt injection; a defence also has to limit the permissions and output channels the model can reach.
方法Method
- 梳理直接、间接与工具链注入入口Map direct, indirect and tool-chain injection entry points
- 建立规则基线与语义分类的分层思路Layer a rule baseline with semantic classification
- 将敏感操作确认和输出过滤放入工程边界Put confirmation of sensitive actions and output filtering inside the engineering boundary
当前观察Current observation
当前公开产物是一篇完整研究笔记和最小检测示例，重点是防御结构与边界条件。What is public today is a complete research note and a minimal detection example, focused on the structure of the defence and its boundary conditions.
限制与下一步Limits and next steps
- 文章中的示例用于解释思路，不应直接作为生产防火墙The examples in the article explain the idea; they should not be used directly as a production firewall
- 公开版本尚未附带完整数据集与可复现实验仓库The public version does not yet ship a full dataset or a reproducible experiment repository