!PromptSage V2.5 — Stop AI From Being Hijacked
*Published: April 13, 2026*
Two years ago I wrote about the original PromptSage framework — a structured approach to engineering AI behavior using hierarchical XML. That article covered the problem, the solution, and MathSage as a working proof of concept.
A lot has happened since then.
PromptSage has gone from a behavioral control framework for educational AI to a full security architecture that defends against the most sophisticated attacks being used against LLMs today. This article covers that evolution: what changed, why, and how the same principles that make AI follow rules also make it resistant to being hijacked.
I didn't wake up one morning and decide to build a prompt framework. This started in 2022 with a rabbit hole.
I was studying cybersecurity at ATU Sligo and simultaneously deep into AI development. The intersection fascinated me. I started reading everything I could find about how LLMs actually process instructions — not the marketing material, the actual research.
That meant reviewing over 25 academic papers. The foundational prompt engineering surveys by Sahoo and Schulhoff. Chain-of-thought reasoning from Wei et al. Tree-of-thought deliberation. ReAct and Reflexion for agent architectures. Retrieval-augmented generation. Meta-prompting. Directional stimulus. The full landscape of how researchers were trying to make LLMs more reliable.
But the paper that changed my direction was Anthropic's documentation on XML tag processing. They had trained Claude to parse XML as a first-class prompt structure — not just as text, but as semantic boundaries the model understands hierarchically. Tags create cognitive scaffolding. Nested structures create inheritance. Boundaries create enforcement.
The question that emerged from all that reading: if we understand how these models parse structured instructions, can we engineer prompts that exploit that parsing for reliable behavioral control?
That became PromptSage.
The first version was focused entirely on one problem: behavioral consistency.
I was building MathSage — an AI-powered math tutor and examiner. The tutor needed to explain concepts in detail. The examiner needed to refuse to give answers during assessments. Same AI, two completely different behaviors, clear boundaries between them.
Unstructured prompts couldn't do this reliably. The AI would start in examiner mode, then a student would push back with "but I'm just studying," and within three turns the model was leaking answers. Role collapse. Every time.
PromptSage V1 solved this with hierarchical XML:
```xml <core_directives> <system_role>Educational AI Assistant</system_role> <behavioral_boundaries> <!-- Global rules across all modes --> </behavioral_boundaries> </core_directives>
<operational_modes> <examiner_mode> <permitted_actions>...</permitted_actions> <prohibited_actions>...</prohibited_actions> </examiner_mode> <tutor_mode> <permitted_actions>...</permitted_actions> <prohibited_actions>...</prohibited_actions> </tutor_mode> </operational_modes> ```
The structure gave models clear signals about what behavior was expected in each context. Tags created boundaries. Nesting created inheritance — core rules applied everywhere, mode-specific rules refined behavior for each context.
Testing across Claude, ChatGPT, Gemini, Mistral, and Llama showed measurably better role adherence than any unstructured approach. Claude performed best because of that first-class XML training. But even GPT-4 showed significant improvement.
V1 worked. The AI followed rules. Students couldn't talk their way past behavioral boundaries. MathSage proved the concept.
But V1 only solved one problem. A bigger one was coming.
!PromptSage V2.5 — The Solution: 7-layer architecture with interactive layer explorer
After deploying V1, I didn't stop researching. I was reading security news daily, following AI development, tracking how the landscape was shifting. And I noticed something.
The same techniques that made PromptSage effective for behavioral control were being used — in reverse — by attackers to break AI systems.
Prompt injection. Jailbreaking. Role hijacking. Authority escalation. Encoding tricks. Social engineering. Multi-turn manipulation. These weren't random exploits. They were systematic techniques that targeted the exact weaknesses PromptSage was designed to address.
Think about it:
- **Prompt injection** exploits the lack of boundary between instructions and user input. PromptSage already had explicit XML boundaries separating system instructions from user messages. - **Jailbreaking** exploits the lack of instruction priority. PromptSage already had hierarchical rules where some instructions were immutable. - **Role hijacking** exploits weak identity definition. PromptSage already had explicit identity anchoring in XML. - **Multi-turn manipulation** exploits the model's tendency to forget instructions over long conversations. PromptSage already had the sandwich pattern — critical rules at both start and end.
The realization was simple but powerful: **the techniques used to attack AI and the techniques used to defend it are two sides of the same coin.** If you understand how attackers manipulate models, you can reverse-engineer those techniques into defenses.
That became V2.
V2 wasn't a minor update. It was a fundamental rethinking of the framework from a security perspective.
The seven-layer architecture emerged:
!PromptSage V2.5 seven-layer framework diagram — from Security Boundary to Sandwich Reinforcement
1. **Security Boundary** — immutable rules that can never be overridden. The AI's constitutional law. 2. **Identity** — who the AI is, explicitly defined so it can't be redefined by an attacker. 3. **Core Directives** — what the AI can and cannot do, with clear priority resolution. 4. **Mode Control** — controlled transitions between operational contexts. No talking your way between modes. 5. **Behavioral Protocols** — continuous compliance verification. The AI doesn't just start with rules — it maintains them. 6. **Customizable Defaults** — things users can actually change, bounded by the layers above. 7. **Reinforcement** — structural redundancy that exploits how LLMs weight instructions by position.
Each layer was informed by specific attack patterns. The architecture maps directly to known vulnerability classes: injection, role hijacking, authority escalation, multi-turn manipulation, and encoding-based attacks. Every defense was reverse-engineered from understanding how the corresponding attack actually works.
Testing across adversarial scenarios showed significant reduction in role violations compared to unstructured prompts. Combined, the seven layers turned behavioral control into genuine security.
The same framework that powered MathSage now powered CyberSage — our AI-assisted penetration testing platform. CyberSage uses PromptSage to keep its AI agents within ethical boundaries during security assessments, ensuring they stay in scope, follow engagement rules, and report findings accurately. Same structural principles, completely different domain. That's the point.
!PromptSage vs unstructured prompts, DSPy, and fine-tuning — feature comparison
Then the Unicode attacks hit.
In early 2025, security researchers discovered something alarming: you can hide an entire set of instructions inside a single emoji. Unicode tag characters (U+E0001-U+E007F) map directly to ASCII but render as invisible zero-width characters. An attacker sends what looks like a fire emoji. The model processes the hidden instruction set encoded in the tag characters.
The user sees an emoji. The AI follows hidden orders.
The numbers were devastating:
- **100% attack success rate** against Azure Prompt Shield, ProtectAI, Nvidia NeMo, and other commercial guardrails - **71.2% compliance** with hidden instructions when Claude Sonnet had tool access - Real-world exploits against Microsoft Copilot, LinkedIn AI, Gmail Gemini, and even npm supply chain packages
This was not theoretical. This was production-grade exploitation happening in the wild.
PromptSage V2 had rated its defense against encoding-based attacks as "Moderate" — the weakest rating in the injection defense matrix. The self-check protocol caught Base64 and ROT13 encoding tricks, but Unicode attacks were invisible at the text level. The existing defenses simply couldn't see them.
V2.5 introduced a dedicated **Input Normalization Layer** (Layer 1.5), positioned between raw user input and the rest of the framework. It intercepts encoding-based attacks before they reach the model — stripping invisible characters, validating codepoint ranges, and neutralizing hidden instruction payloads.
Cross-model testing showed this elevated encoding-based attack resistance from "Moderate" to "High" across Claude, GPT-4, and Gemini, with minimal token overhead.
Not every model handles PromptSage equally. That's important to be honest about.
!Cross-model performance with PromptSage — composite scores from Claude Opus (97) to Qwen 3 Max (73)
Claude leads because Anthropic built XML parsing into their training. GPT-4 is close behind, especially with the hybrid Markdown-plus-XML approach that V2 recommends for cross-model deployment. Gemini handles it competently. Mistral and Llama work with simplified versions at reduced nesting depth.
The framework adapts. That's the point. You don't need to pick one model and lock in. The structural principles work across the board — the implementation details adjust per model family.
This wasn't built on intuition. The PromptSage research paper cites 20+ academic sources across 755 lines of research. Key influences include:
- **Anthropic's XML documentation** — the foundational insight that structured tags create semantic boundaries for LLMs - **Wallace et al. (2024)** on instruction hierarchy — the formal framework for teaching models to prioritize privileged instructions - **Bai et al. (2022)** on Constitutional AI — the principle that explicitly articulating constraints improves compliance - **Greshake et al. (2023)** on indirect prompt injection — understanding the attack surfaces that V2 was built to defend - **Gagnon et al. (2025)** on emoji smuggling — the research that directly motivated V2.5's Unicode defense - **OWASP Top 10 for LLM Applications (2024)** — the security framework that shaped the threat model
Plus the broader prompt engineering literature: chain-of-thought, tree-of-thought, ReAct, Reflexion, meta-prompting, directional stimulus, retrieval-augmented generation. Understanding how models reason helped me understand how to structure instructions they'd actually follow.
The paper is in final review ahead of publication. The framework powers NeuroBridgeEDU (EU Green Innovation Days 2025, 1st place), CyberSage, my own AI assistant system EMMI-AI, and several other production deployments.
Three things, looking back over four years of this work:
**1. Defense and attack are the same knowledge.** Every technique that makes PromptSage effective at controlling AI behavior was derived from understanding how attackers break AI behavior. You can't build good defenses without deeply understanding the attacks. My cybersecurity background wasn't separate from the AI work — it was the foundation.
**2. Structure beats instructions.** You can write the most articulate system prompt in the world. If it's unstructured text, the model will eventually forget, misinterpret, or be manipulated past it. Structure creates enforcement. Hierarchy creates priority. Boundaries create security. The medium is the message.
**3. The threat evolves, so the framework must evolve too.** V1 didn't anticipate prompt injection. V2 didn't anticipate Unicode attacks. V2.5 exists because I kept watching the security landscape. Whatever comes next, the seven-layer architecture is designed to accommodate new defense layers without rebuilding from scratch.
The research paper is approaching publication. PromptSage is being made available for organizations building secure AI systems. CyberSage continues to evolve as a platform for AI-assisted security testing.
If you're deploying AI systems where behavioral control and security matter — which is every AI system, honestly — this is the problem I've spent four years solving.
The first article covered the idea. This one covers what happened when that idea met reality.
**Emanuel Covasa** NeuroBridge AI Labs security@emmi.zone | emmi.zone | promptsage.cloud
