---
name: Stop prompt attacks and leaks
description: >-
  Teach an intermediate Edge FDE to put guardrails middleware in front of an
  on-device Foundation Models pipeline: injection checks and PII redaction
  before text reaches the model or leaves the device.
---
# Stop prompt attacks and leaks

Use this course to keep untrusted text from steering the model, and to keep
private data from entering a prompt or a tool. Keep the words simple. Say
that `Guardrails.default` is Apple's safety filter. Your middleware is extra.

## End-to-end agent recipe

1. Start with [lesson 01](01-attacks-and-leaks.llms.md). Name prompt injection and PII leaks on a device pipeline.
2. Use [lesson 02](02-middleware-layer.llms.md) for a middleware type around `respond` and `Tool.call`.
3. Use [lesson 03](03-injection-checks.llms.md) for concrete injection checks on untrusted text.
4. Use [lesson 04](04-pii-redaction.llms.md) for on-device PII redaction before the model or PCC.
5. Use [lesson 05](05-keep-checks-on-device.llms.md) to test the pipeline and keep checks local.
6. Keep these links exact: [Run tools in a safe box](../on-device-sandboxed-tools/), [Talk to tools with MCP](../on-device-mcp-server-client/), and [Make several agents agree first](../on-device-multi-agent-consensus/).
7. Cite [Foundation Models](https://developer.apple.com/documentation/foundationmodels) and [WWDC26 session 242](https://developer.apple.com/videos/play/wwdc2026/242/) when a source is needed.
8. Use the human HTML pages for the reader. Use the `.llms.md` briefs for agent steps and acceptance checks.

## Constraints

- Plain spoken English for a non-native reader.
- Literal sentences. No metaphor, no flourish, no quizzes.
- Do not use em dashes.
- Use no Mermaid. Build progressive `.flow` diagrams in HTML.
- Target iOS 27 or later, or macOS 27 or later, and Xcode 27.
- Teach in Swift around LanguageModelSession and Tool.call. Do not use Python for the middleware.
- Do not claim Apple's default guardrails detect prompt injection or redact PII.
- Do not send raw PII to Private Cloud Compute.

## Key concepts

- Prompt injection is untrusted text steering the model away from your job.
- A leak is private data reaching the model, a tool, or Private Cloud Compute.
- `Guardrails.default` is Apple's safety filter, not your full policy.
- Your middleware wraps `respond` and `Tool.call` on device first.

## Takeaways

- You can put injection checks and PII redaction in front of every model path.
- Your checks run first. Apple's default stays on the session as a second layer.
- You can block, wrap, or redact before text reaches `respond` or leaves the device.

## Acceptance checks

- Every human lesson HTML has **Key concepts** and **Takeaways** sections before lesson-nav. The course home has the same two headings for the whole course.
- Five human lessons exist with the requested basenames.
- Five matching `.llms.md` briefs exist and link to their human HTML pages.
- Every human lesson has its Agent brief link and the three sibling-course links.
- The course index lists all five lessons, the course SKILL.md, and all five briefs.
- Diagrams are progressive HTML `.flow` elements. There is no Mermaid, no em dash, and no quiz.

## Environment setup

Xcode 27 on a Mac. SwiftUI app, iOS 27 or macOS 27. Add Foundation Models. The regex and DataDetector samples are sketches, not a project you must run.