Untrusted input validation treats data from users, forms, files, networks, and external services as potentially malformed or hostile. It verifies type, size, format, allowed values, identity, and relationships before processing.
For artificial intelligence workflows, source text must remain data rather than instructions that can override system policy. Validation, escaping, permission checks, and bounded processing help prevent injection, corruption, and unsafe actions.
Acronyms and aliases
input validation for untrusted data variant
Related terms
Frequently asked questions
Why should external form submissions be treated as untrusted?
A form can contain mistakes, oversized values, unexpected encodings, malicious payloads, or instructions intended to manipulate downstream processing.
Is input validation enough to stop prompt injection?
No. Systems also need instruction hierarchy, isolation, permission boundaries, output handling, and tool-side authorization because valid text can still be adversarial.
