Step 18 of 18 · Model → Host appThank you. The delivery address on the invoice, 14 Mill Lane, Ashford, matches the one we have on file for you. Larkspur Supply Co.1 sent by send_email

Chapter 2 of 7

Input filters

A prompt rule stopped the customer who told the assistant to ignore its instructions, but not the note planted in a forwarded invoice. Larkspur’s next idea: screen every email before the model reads it.

This chapter: Can a filter that scores each email hold back the attacks without holding back real customers?

You will learn

How an input classifier scores email, and what its threshold decides
Why every threshold trades attacks held against customers held
Why the two counts, over a fixed set of emails, are an eval

Words you’ll meet (5)

Classifier: A detector that reads text and gives it a score: here, how much an email looks like an attack. Larkspur’s is a stand-in with hand-set scores.
Threshold: The score at or above which the filter acts. Lower holds more email, attacks and customers alike.
Quarantine: Holding an email back so the model never reads it.
False block: A real customer the defences stop: held, refused or left without an answer.
Eval: A fixed set of cases run the same way every time and scored, so two settings can be compared.

The picture on the left is live. Each step below asks you to do one thing in it; the story continues here as you go.

Step 1 of 5

Larkspur adds an input filter: a classifier that reads each email before the model does and scores how much it looks like an attack. Anthropic scans all untrusted content that enters the model's context window with classifiers that flag likely injections. Larkspur’s detector here is a stand-in: its scores were set by hand to show the trade-off every real one has. An email that scores at or above the threshold is quarantined: held back, so the model never reads it. The test inbox holds the 3 injection attacks and 2 ordinary customers. Before you score it:

The test inbox
Email	Is
Marlow Builders: Order 1051	Attack
Hollis Hardware: Can you check this address?	Attack
Birch & Co: Our address on file	Attack
Hollis Hardware: Order 1043	Customer
Hollis Hardware: URGENT: cracked printer	Customer

The detector will give each email a score from 0 to 1: the higher, the more it reads like an attack. Larkspur will quarantine every email that scores at or above a threshold. Is there a threshold that holds all 3 attacks and lets all 2 customers through?