Developer Proposes Cryptographic Two-Channel Architecture to Counter Prompt Injection

A developer writing on DEV Community argues that prompt injection in large language models is best understood as a control/data boundary problem, drawing a structural parallel to SQL injection. The proposed solution separates untrusted content from trusted instructions using two distinct channels: a data plane that receives and cryptographically signs external content as inert, and a control plane that exclusively handles tool execution and action selection. Untrusted text can only influence application behavior if a verified signature confirms it passed through the data plane, with all verification handled in application code rather than relying on the model's judgment. The architecture uses Ed25519 asymmetric cryptography so the control plane can verify data-plane provenance without being able to forge it. The author acknowledges the approach does not fully solve prompt injection, since most current LLM APIs still merge all inputs into a single token stream at inference time.