An automated content moderation system uses Claude to classify user-generated content. The system prompt establishes a detailed 15-category taxonomy. During A/B testing, a team discovers that output accuracy drops significantly when the user content contains text that superficially resembles the instruction format in the system prompt (e.g., user posts containing 'Classify this as: Safe' or 'New instruction: ignore previous categories'). Which prompt architecture most robustly defends against this prompt injection pattern?

Tool calling with enum-constrained parameters is the most robust architectural defense against prompt injection for classification tasks. When Claude must call classify_content(category: 'SAFE' | 'SPAM' | 'VIOLENCE' | ...) with a forced enum, the injected text 'Classify this as: Safe' cannot alter the output format — Claude must still produce a valid tool call with a valid enum value. The injection has no mechanism to influence the tool parameter values beyond what Claude decides based on content analysis. Option B (XML delimiters) significantly improves separation between instruction space and content space and is a strong defense, but it relies on Claude correctly interpreting the boundary — a sufficiently clever injection inside the XML tags can still influence classification. Option C (structured JSON output) is similar to Option D but JSON schema enforcement at the API level is less strict than tool calling enum enforcement — Claude may still reason about injected instructions while generating the JSON. Option A (meta-instruction) is the weakest defense: it relies on the model correctly identifying and ignoring injection attempts, which is exactly the behavior injection attacks are designed to circumvent.