Defense in Depth

The defense-in-depth principle involves deploying multiple independent protective measures at different levels of a system, so that even if an attacker breaches one layer of defense, they still face subsequent layers of obstruction.

Defense in Depth refers to deploying multiple independent layers of security controls so that an attacker must breach every layer before causing substantive damage

Defense in depth is a security design philosophy that advocates building a multi-layered, complementary defense system rather than relying on a single security barrier.

One should rely on defense in depth rather than single-point concealment, including strong authentication, the principle of least privilege, encryption, audit logs, and timely patching.

Defense in depth is currently the most pragmatic strategy for addressing prompt injection, involving the layering of security measures across multiple levels including input, model, output, and application.

The combination of the three dimensions forms defense in depth: tool visibility controls the entry point, field masking controls data outflow, and request limits control the intensity of behavior; if any single dimension is bypassed, the other dimensions still provide constraints.

A 20% patch rate means most vulnerabilities are never addressed, and defenders must design defense in depth assuming systems remain unpatched for long periods.

Excluding sensitive assets from the model inference path can architecturally eliminate an entire class of risk without relying on the reliability of the model's own judgment.

Because LLMs cannot strictly distinguish 'instructions' from 'data' the way traditional programs do, prompt injection is difficult to eradicate with a single filter and usually requires a combination of defense-in-depth measures such as bidirectional input-output detection, least privilege, and tool-call whitelists.

Credential masking needs to be combined with measures such as least privilege, short-lived tokens, and key rotation, and the industry generally regards it as one layer of defense in depth.

The community discussion's emphasis on "assuming by default that the model may find paths unforeseen by the designers" corresponds to the defense in depth concept in security engineering—not relying on a single line of defense, but assuming each layer may be breached and thus designing multiple independent lines of defense.

Because current large models fundamentally cannot distinguish "data" from "instructions," there is no perfect solution to prompt injection, and the industry generally adopts defense in depth (least privilege, human approval, output isolation, input filtering and full logging).

Defense-in-depth measures on the service side include rate limiting, behavioral fingerprinting, CAPTCHA challenges, and login failure lockout, which can raise the cost of abuse without harming normal anonymous users.

Learna Tutor's safety design adopts a three-layer defense-in-depth architecture: input filters, model system prompts, and output filters.

Loreflow's design covers only the answer pipeline; the retrieval layer, authentication layer, and connector layer have their own defenses (permission-mirrored reads, Clerk-scoped operations, fail-closed configuration).

The information security field generally follows the principle of 'defense in depth', meaning that digital measures such as network firewalls, encryption, and permission management must be combined with physical protection to form a complete closed loop.

针对ICS的纵深防御策略建议在OT网络边界部署防火墙和入侵检测系统，对关键控制指令进行白名单过滤，并定期进行漏洞扫描与固件更新。

Defense in depth advocates layering security controls across multiple independent levels.

Using a single isolation mechanism as the only line of defense and lacking independent backup protection violates the principle of defense in depth.

When AI-assisted reverse engineering makes static obfuscation increasingly easy to penetrate, server-side behavioral detection architecture holds greater long-term value than continuously escalating client-side encryption complexity.