Defenses against prompt injection mainly proceed along three technical lines: input sanitization and detection, architecture-level isolation, and the principle of least privilege.