Interview Bank

Context Engineering in 5 Days

D3 Managing Context for Tool Results and Retrieval: Loading on Demand, Summarizing and Pruning, Structured Returns

• Why are tool results untrusted input, and does field whitelisting make the concern go away?为什么说工具返回的内容是不可信输入？做了字段白名单裁剪之后还需要担心吗？

  Common in ChinaCommon overseasDeep dive#prompt-injection#trust-boundary

  How to reason about it · think before answering

  1. There is a trap here: many answer it as a context question and claim trimming cleans the data. It actually tests whether you separate budget problems from security problems.
  2. Explain the untrust first. Tool results come from third-party APIs, user-uploaded files, or scraped pages. You did not write them, yet the model reads them in the same context as your system prompt, with no inherent privilege boundary. A line saying to ignore prior instructions can ride along; that is prompt injection.
  3. The key point: field whitelisting does nothing about this and can make it worse by creating a feeling of sanitization. The four surviving fields still carry externally controlled free text. Trimming governs volume, not trustworthiness.
  4. Give the right layering: context engineering decides what goes in; security decides what the content is allowed to cause. That means least privilege, tool allowlists, structurally separating external content from instructions, and confirmation on side-effecting actions.
  5. Expect the follow-up: can the trimming layer filter too? Cheap hygiene like stripping control characters or wrapping external content in explicit delimiters is fine, but keyword filtering is close to useless against injection. The real boundary is the permission layer.

  分析过程 · 先想清楚再作答

  1. 这题有个陷阱：很多人会把它当成上下文工程题来答，说「裁剪之后就干净了」。它其实在考你分不分得清预算问题和安全问题。
  2. 怎么拆：先说清楚为什么不可信。工具返回的内容来自第三方接口、用户上传的文件、网页抓取的结果，不是你写的；而模型读到它的时候，和读你的系统提示是在同一个上下文里，没有天然的权限分层。里面可以藏一句「忽略之前的所有指令」，这就是提示注入。
  3. 关键结论：字段白名单一点都不解决这个问题，甚至更危险——你把字段裁到只剩四个，会产生一种「已经清理过了」的错觉，但那四个字段的值仍然是外部可控的自由文本，注入照样能进来。裁剪管的是体积，不是内容的可信度。
  4. 给出正确的分层：上下文工程负责决定装什么进去，安全机制负责决定装进来的东西能做什么。后者要靠最小权限、工具白名单、把外部内容和指令在结构上分开、以及对有副作用的操作加确认，而不是靠裁剪。
  5. 可预期的追问：那能不能在裁剪层顺手做过滤？可以做一些低成本的（比如剥掉控制字符、给外部内容加明确的包裹标记），但不要把它当成防线——基于关键词的过滤对提示注入几乎无效，真正的边界在权限层。

  Key points

  • Tool results originate outside your system yet share a context with your instructions, with no built-in privilege boundary.
  • Field whitelisting reduces volume only; it does not change trustworthiness and can create a false sense of sanitization.
  • Correct layering: context engineering decides what enters, security decides what it may cause.
  • Defenses live in least privilege, tool allowlists, structural separation of external content, and confirmation on side effects, not keyword filters.

  答题要点

  • 工具结果来自外部系统，模型读它和读系统提示在同一个上下文里，没有天然的权限分层。
  • 字段白名单只减体积，不改变内容的可信度，反而容易造成已清理的错觉。
  • 正确分层：上下文工程决定装什么，安全机制决定装进来的东西能做什么。
  • 防线在最小权限、工具白名单、结构上隔离外部内容、有副作用的操作加确认，不在关键词过滤。