Prompting
Delimiter
A delimiter marks where one section of a prompt ends and another begins, usually with XML-style tags.
Without one, a model reading three thousand tokens of reference material followed by an instruction has no structural signal for where the data stopped. It infers, and on long inputs it sometimes infers wrong.
Tags cost roughly eight tokens per section and are one of the few prompt techniques with a consistent, cheap and uncontroversial effect above a few hundred tokens of context.
In practice
Delimiters are the cheapest prompt injection mitigation that exists and the one most often missing. Without them the model has to infer where your instructions end and the user's data begins, and that inference is precisely what an attacker manipulates. XML-style tags work well because they rarely appear by accident in ordinary text.
Common questions
What is the best delimiter for prompts?
XML-style tags work well because they rarely appear by accident in ordinary text and models handle them reliably. Triple backticks are common but collide with code blocks in the content you are delimiting.
Do delimiters stop prompt injection?
They reduce it substantially and do not eliminate it. They are the cheapest available mitigation, which is why omitting them is hard to defend — but permissions still belong in code, not in the prompt.