> The best you could do is not allow the LLM to ingest untrusted input. How would that even work in practice, when an LLM is mostly to be used by a user, which

> The best you could do is not allow the LLM to ingest untrusted input. How would that even work in practice, when an LLM is mostly to be used by a user, which will provide by default, untrusted input?