An end-to-end encrypted scratchpad can to some extent limit the propagation path of prompt injection attacks, but genuine protection still requires combining access control and content validation mechanisms.