Defenses against prompt injection (classifiers, instruction hierarchies, source labels) are without exception probabilistic; the model may be bypassed by novel phrasing, and classifiers may misjudge legitimate input.