Out-of-Band Prompt-Injection Defense

Second-generation prompt-injection defense enforced outside the model: a deterministic reference monitor mediates tool calls (CaMeL, FIDES, Progent, APPA) instead of training refusal — validated by an independent adaptive-attack reproduction, with cost inversions showing the overhead is a property of LLM-authored policy, not of enforcement.