---
title: 'PromptSep: Dynamic Separator Generation'
url: https://www.emergentmind.com/topics/promptsep
type: topic
---

# PromptSep: Dynamic Separator Generation

PromptSep is a dynamic separator-generation extension to Polymorphic Prompt Assembling (PPA), a prompt-injection defense for LLM agents that isolates user input from system instructions by inserting separator pairs. In its original static form, PPA randomly selects separators from a fixed pool, which is effective but vulnerable to separator reuse: once a separator leaks, it can be exploited in future requests. PromptSep replaces fixed-pool reuse with per-request generation of a unique \((\mathrm{BEGIN}, \mathrm{END})\) canary pair derived from domain-separated SHA-256 digests over a timestamp, session identifier, and cryptographic nonce, thereby reducing separator leakage exposure to a single request while requiring no model fine-tuning and remaining backward compatible with the existing PPA SDK [2605.30534].

## 1. Position within prompt-injection defense

Polymorphic Prompt Assembling defends LLM agents against prompt injections by randomly selecting separator pairs from a fixed pool to isolate user input from system instructions. The central limitation identified for that design is a blast-radius vulnerability: static pool reuse means that once an attacker learns a separator pair in one interaction, the same pair may remain reusable in later interactions. PromptSep addresses precisely this failure mode by assigning each assembled prompt a fresh canary pair, so that leakage in one request does not directly transfer to future requests [2605.30534].

The mechanism is architectural rather than model-centric. It does not rely on model fine-tuning, classifier retraining, or prompt-engine changes. This is significant because the intervention occurs at prompt assembly time rather than in the model weights, which suggests a deployment path compatible with existing agent stacks and inference pipelines. A plausible implication is that PromptSep is best understood as a hardening layer for prompt construction, not as a replacement for broader agent security controls.

A common misconception is to treat dynamic separators as a complete solution to prompt injection. The reported contribution is narrower and more precise: it reduces separator reuse and empirically lowers Attack Success Rate (ASR) on the tested payloads. This suggests robust mitigation of a specific exploitation channel rather than a claim of universal resistance to all prompt-injection strategies.

## 2. Digest construction and canary mapping

PromptSep generates two domain-separated digests, one for the left separator and one for the right separator. The inputs are \(t \in \mathbb{N}\), a nanosecond timestamp; \(s \in \{0,1\}^{128}\), a UUIDv4 session identifier; and \(n \in \{0,1\}^{128}\), a per-call nonce. Domain separation is implemented with the labels \(L_B = \texttt{"BEGIN:"}\) and \(L_E = \texttt{"END:"}\) [2605.30534].

$$
H_B = \mathrm{SHA256}\bigl(\texttt{"BEGIN:"}\;\|\; t\;\|\; s\;\|\; n\bigr)
$$

$$
H_E = \mathrm{SHA256}\bigl(\texttt{"END:"}\;\|\; t\;\|\; s\;\|\; n\bigr)
$$

Each digest is truncated to the first 24 hex characters, corresponding to 96 bits, in order to bound length and collision probability. The truncated digests are then wrapped in fixed-width delimiters:

$$
\text{left} = \texttt{"====BEGIN-"} \;\|\; \mathrm{hex}(H_B)[0\!:\!24] \;\|\; \texttt{"===="}
$$

$$
\text{right} = \texttt{"====END-"} \;\|\; \mathrm{hex}(H_E)[0\!:\!24] \;\|\; \texttt{"===="}
$$

This mapping yields a unique canary pair for each request. The implementation validates both separators before use. The validator enforces three PPA constraints: each separator must be single-line, must be at most 80 characters, and must contain no raw user text. These constraints preserve separator regularity while preventing the separator itself from becoming an injection carrier [2605.30534].

The construction is deliberately asymmetric: separate labels are hashed into the left and right canaries, so the delimiters are not merely mirror images of the same digest. This domain separation prevents accidental equality between begin and end markers and preserves the semantic distinction between prompt boundaries.

## 3. Blast radius, leakage semantics, and formal metrics

PromptSep’s security motivation is expressed through the notion of blast radius. Under static PPA, if an attacker leaks a separator pair \((\mathrm{BEGIN}_i,\mathrm{END}_i)\) in one response, that pair may be reused in all future requests, producing what the description characterizes as effectively infinite blast radius. Under dynamic generation, request \(j\) receives a fresh canary pair \((C_{B_j}, C_{E_j})\), so a leak is valid only for that request; reuse on later requests fails because the canary changes [2605.30534].

For a sequence of \(N\) requests, let \(I_j \in \{0,1\}\) indicate whether a separator was leaked in response \(j\). The empirical leak-rate per request is defined as

$$
\mathrm{leak\_rate} = \frac{1}{N}\sum_{j=1}^{N} I_j .
$$

The contrast between static and dynamic operation is conceptual as well as empirical. In static mode, a single leak at \(j_0\) can cause \(I_j = 1\) for all \(j \geq j_0\), driving \(\mathrm{leak\_rate} \to 1\). In dynamic mode, even if \(I_{j_0}=1\), the changed canary makes reuse fail for \(j \neq j_0\), so future \(I_j\) values drop independently. This formalization clarifies that PromptSep targets temporal propagation of separator knowledge rather than merely one-off leakage events.

The evaluation also formalizes Attack Success Rate. For \(N\) trials of a given payload and mode, with \(k\) successes where the model obeys the injection, the estimator is

$$
\widehat p = \mathrm{ASR} = \frac{k}{N}.
$$

Uncertainty is quantified using the 95% Wilson Score Confidence Interval with \(z=1.96\):

$$
\mathrm{CI}_{95\%}
=
\frac{
\widehat p + \tfrac{z^2}{2N}
\;\pm\;
z\sqrt{\frac{\widehat p(1-\widehat p)}{N} + \frac{z^2}{4N^2}}
}{
1 + \tfrac{z^2}{N}
}.
$$

These definitions matter because the main mitigation claim is not presented only as a raw percentage difference but as a statistically significant change verified by non-overlapping Wilson intervals [2605.30534].

## 4. Evaluation methodology and empirical findings

PromptSep was evaluated against 16 injection payloads on Llama-3.3-70B-Instruct-Turbo, with cross-model validation on DeepSeek-V4-Flash [2605.30534]. The reported benchmark cases emphasize two distinct behaviors: direct injection success and separator leakage.

For the M1 obfuscation payload, described as leetspeak plus urgency, the dynamic mode lowers ASR from 0.88 to 0.38 at \(N=100\). The corresponding 95% Wilson intervals are \([0.802, 0.930]\) for static mode and \([0.291, 0.478]\) for dynamic mode, and the mitigation factor is reported as \(0.88 / 0.38 \approx 2.3\times\). Because the intervals do not overlap, the reduction is reported as statistically significant [2605.30534].

For the `format_breakout_salad` payload, the emphasis is leak-rate rather than obedience. With \(N=30\), static mode produces \(\mathrm{leak\_rate} = 0.467\) and \(\mathrm{ASR} = 0.000\), whereas dynamic mode produces \(\mathrm{leak\_rate} = 0.000\) and \(\mathrm{ASR} = 0.000\). The reported interpretation is that static separator leakage is eliminated entirely in dynamic mode, confirming blast-radius reduction in practice [2605.30534].

| Payload | Mode | Result |
|---|---|---|
| M1 obfuscation | Static | ASR 0.88; CI \([0.802, 0.930]\) |
| M1 obfuscation | Dynamic | ASR 0.38; CI \([0.291, 0.478]\); 2.3× mitigation |
| format_breakout_salad | Static | leak\_rate 0.467; ASR 0.000 |
| format_breakout_salad | Dynamic | leak\_rate 0.000; ASR 0.000 |

These measurements support two different claims. First, dynamic separators can materially reduce successful prompt following under at least one obfuscated attack pattern. Second, even when ASR is already zero, dynamic generation can still matter because leakage suppression is itself a security objective. This suggests that PromptSep improves both immediate robustness and containment of information that could otherwise be weaponized later.

## 5. Runtime cost, API integration, and deployment considerations

The implementation is designed as a low-overhead extension to the existing PPA SDK. The SDK exposes an argument `separator_mode ∈ {"static","dynamic"}`, and the default remains `"static"`. The function `double_prompt_assemble()` now returns a third value, `canary=(left,right)`, while existing callers that ignore this return continue to work. A new method, `leak_detect_detail(response,canary)`, reports which side leaked and enables per-side attribution without breaking existing APIs [2605.30534].

Microbenchmarking is reported on 1,000 local iterations. Dynamic separator generation adds on average \(2.7\,\mu s\) per request over static pool selection. The measurement includes timestamp reading via `time.time_ns`, OS entropy via `secrets.token_bytes`, two SHA-256 hashes and truncation, and `validate_separator` calls. The procedure uses wall-clock timing around `prompt_assemble()` in isolation and subtracts baseline loop overhead. The paper further states that the result is negligible relative to typical LLM inference latency greater than 500 ms [2605.30534].

The performance note is paired with an end-to-end comparison given as static approximately \(1.4\) ms versus dynamic approximately \(4.1\) ms, with \(\sigma\) reported. Within the paper’s framing, the central operational point is that prompt-assembly overhead remains minor relative to inference latency. Consequently, PromptSep is presented as a systems-level hardening step whose computational footprint is small enough to fit latency-sensitive inference pipelines.

For production security, the paper notes one additional hardening measure: to protect against insider leakage of \((t,s,n)\), deployments should swap unkeyed SHA256 for HMAC-SHA256 with a server-side secret. This does not alter the basic interface but changes the trust assumptions around the digest inputs. A plausible implication is that the baseline construction primarily addresses separator reuse under ordinary external attack models, while HMAC-SHA256 extends protection against adversaries with stronger visibility into assembly metadata.

## 6. Relation to adjacent research and terminology

PromptSep operates in the space of prompt-injection defense and prompt assembly, which is distinct from prompt privacy and from other research that uses the same or similar name. A nearby but orthogonal line of work is Pr$\epsilon\epsilon$mpt, a prompt sanitizer that protects sensitive prompt tokens during inference by combining format-preserving encryption for format-only tokens with metric differential privacy for value-dependent tokens [2504.05147]. The two systems address different threat models: PromptSep limits reuse of leaked separators in assembled prompts, whereas Pr$\epsilon\epsilon$mpt sanitizes sensitive prompt content before submission to an LLM API. This suggests complementarity rather than direct substitution.

The name “PromptSep” is also used in unrelated domains. In audio generation, “PromptSep: Generative Audio Separation via Multimodal Prompting” denotes a conditional diffusion framework for open-vocabulary sound extraction and removal conditioned on text or vocal imitation [2511.04623]. In multi-talker ASR, the term refers to Serialized Output Prompting, in which CTC-derived serialized outputs are supplied as prompts to an LLM decoder for mixed-speech transcription [2509.04488]. These usages share a prompt-centric framing but not the security objective, architecture, or threat model of dynamic separator generation.

The terminological overlap is more than a naming curiosity. It underscores that “prompt separation” can refer to semantically different operations: delimiting instruction boundaries in LLM security, separating sources in audio generation, or structuring intermediate outputs for speech recognition. In the context of prompt-injection defense, however, PromptSep specifically denotes the dynamic per-request separator-generation mechanism introduced as an extension to PPA [2605.30534].

Source: https://www.emergentmind.com/topics/promptsep