# Mitigating prompt injection attacks with a layered defense strategy

DevFeed: [Mitigating prompt injection attacks with a layered defense strategy](<https://devfeed.tech/articles/mitigating-prompt-injection-attacks-with-a-layered-defense-strategy-19796.md>)

Original publisher: [Read original article](<http://security.googleblog.com/2025/06/mitigating-prompt-injection-attacks.html>)

Author: Kimberly Samra (noreply@blogger.com)

Published: 2025-06-13T16:03:00Z

Content type: opinion

Language: en

Sources: [Google Online Security](<https://devfeed.tech/sources/google-online-security.md>)

Topics: [prompt injection](<https://devfeed.tech/topics/prompt-injection.md>), [ai security](<https://devfeed.tech/topics/ai-security.md>), [Generative AI](<https://devfeed.tech/topics/generative-ai.md>), [Google](<https://devfeed.tech/topics/google.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [ai-security](<https://devfeed.tech/tags/ai-security.md>), [defense-in-depth](<https://devfeed.tech/tags/defense-in-depth.md>), [generative-ai](<https://devfeed.tech/tags/generative-ai.md>), [google](<https://devfeed.tech/tags/google.md>), [none](<https://devfeed.tech/tags/none.md>), [prompt-injection](<https://devfeed.tech/tags/prompt-injection.md>), [red-teaming](<https://devfeed.tech/tags/red-teaming.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

Google describes a layered defense strategy for mitigating indirect prompt injection attacks in Gemini. The approach combines model hardening, machine-learning classifiers, adversarial training, sanitization, user confirmations, and security notifications across the prompt lifecycle.

## Source excerpt

Posted by Adam Gavish, Google GenAI Security Team With the rapid adoption of generative AI, a new wave of threats is emerging across the industry with the aim of manipulating the AI systems themselves. One such emerging attack vector is indirect prompt injections. Unlike direct prompt injections, where an attacker directly inputs malicious commands into a prompt, indirect prompt injections involve hidden malicious instructions within external data sources. These may include emails, documents, or calendar invites that instruct AI to exfiltrate user data or execute other rogue actions. As more governments, businesses, and individuals adopt generative AI to get more done, this subtle yet potentially potent attack becomes increasingly pertinent across the industry, demanding immediate attention and robust security measures. At Google, our teams have a longstanding precedent of investing in a defense-in-depth strategy, including robust evaluation, threat analysis, AI security best practices, AI red-teaming, adversarial training, and model hardening for generative AI tools. This approach enables safer adoption of Gemini in Google Workspace and the Gemini app (we refer to both in this blog as "Gemini" for simplicity). Below we describe our prompt injection mitigation product strategy based on extensive research, development, and deployment of improved security mitigations. A layered security approach Google has taken a layered security approach introducing security measures designed for each stage of the prompt lifecycle. From Gemini 2.5 model hardening, to purpose-built machine learning (ML) models detecting malicious instructions, to system-level safeguards, we are meaningfully elevating the difficulty, expense, and complexity faced by an attacker. This approach compels adversaries to resort to methods that are either more easily identified or demand greater resources. Our model training with adversarial data significantly enhanced our defenses against indirect prompt in