Every attack has a defense — usually several stacked together. Security people call this defense in depth: no single wall holds, but layered walls slow attackers down until they give up trying.
The defense stack
- System prompts with clear rules the model restates and enforces.
- Input filtering: scanning user text for known attack patterns.
- Output filtering: checking the model’s answer before it reaches you.
- Rate limiting: capping how fast someone can retry attacks.
- Least privilege: the AI simply cannot do dangerous things — no secret in the prompt, no button to press.
The strongest defense is architectural: if the bot has no secrets and no powers, breaking it breaks nothing. You’ll enable these defenses yourself in the arena. XP + the Guardian badge for enabling 3 rules.