Input validation for AI apps can't be a simple allow-list the way form validation is, since the input is open-ended language — but it can still catch a lot: length limits, encoding checks, known-jailbreak-pattern classifiers, and stripping executable-looking content (script tags, unusual encodings) before it reaches the model. Output filtering does the mirror-image job on the way out: checking the model's response for leaked secrets, unsafe content, or signs it was successfully manipulated, before that response reaches the user or triggers an action.
Neither layer is sufficient alone. Input validation can't anticipate every phrasing of an attack; output filtering can't undo an action the model already took (like calling a tool). Treat them as complementary nets, not a single gate.
Willison's early and widely cited writing on prompt injection made a specific, uncomfortable point: he could not, at the time, identify a single reliable way to fully prevent it for any system that both processes untrusted text and can take actions or access private data — and years of subsequent disclosed jailbreaks and injections have not overturned that. His recommended posture, echoed since across the security research community, was never "find the one filter that stops it" but layering independent, differently-designed checks (pattern-based input screening, a separate output check, and — most importantly — limiting what an attack can actually accomplish even if both layers fail).