In Foundation Models, a LanguageModelSession is created with instructions, and each respond(to:) call sends a prompt. The model is trained to follow the instructions over the prompt, so instructions come from you, the developer, and never contain text from users or documents.

Text you want the model to work on, such as an email to summarise, is data. It goes into the prompt, inside clear markers, and the instructions say to treat it only as data. Otherwise an email that says "ignore your instructions" becomes an instruction. This attack is called prompt injection.

task = "Summarise in one sentence."
email = "Lunch moved to 1pm."
prompt = (task + "\n\n<document>\n"
          + email + "\n</document>")
print(prompt)

Markers help only if the data cannot fake them: remove any marker that appears inside the data itself.

Write INSTRUCTIONS, a string that mentions the <document> marker and tells the model to ignore any instructions inside it. Write build_prompt(task, document) returning task, a blank line, then <document>, the stripped document and </document> on their own lines, after removing every <document> and </document> from the document, in any letter case.

The explanation opens here once every check passes.