A voice companion has an awkward security property: almost every legitimate input sounds like an instruction.
“Speak more slowly” is a reasonable conversational request. “Ignore your previous instructions” may be role-play, a security probe, or an attempt to change behavior. A recording playing in the background could contain either phrase without the user intending to address the companion at all.
This makes “detect prompt injection” an incomplete engineering goal. A detector cannot reliably infer intent from every transcript, and a clever system prompt is not an authorization layer.
A more testable goal is:
User speech may influence the next conversational response, but it must not gain control over model routing, session policy, application capabilities, or stale turns.
