A sandwich check is a safeguard that places an artificial intelligence (AI) model between two layers of verification. The top layer screens what goes into the model: who is asking, what data is allowed, which instructions frame the task. The bottom layer inspects what comes out before anything happens with it: a budget is spent, an ad goes live, a message reaches a customer. The model is the filling. It exists because large language models (LLMs) are probabilistic. The same prompt can produce different answers, some of them wrong, and a model cannot reliably tell a legitimate instruction from a malicious one hidden in the text it reads. Rather than trusting the model, the sandwich trusts the slices around it.

The phrase is informal. No standards body defines "sandwich check", and as of October 2026 it does not appear in PPC Land's coverage, IAB Tech Lab specifications or platform documentation. The pattern goes by other names: the "LLM sandwich" in enterprise software, the "AI sandwich" in workplace design, the "sandwich defense" in prompt security. The layered approach behind them now runs through much of the agentic advertising infrastructure launched in 2025 and 2026.

How a sandwich check works

The structure has three parts, and each can be automated, human, or both.

The top slice is pre-processing. According to an April 10, 2026 guide from enterprise AI vendor Gyde, this layer is rule-based rather than AI. It sends questions with fixed answers straight to a database, checks the user's role, blocks unauthorised requests, retrieves approved documents and picks which model, if any, handles the job.

The filling is the model call itself: drafting a media plan, writing ad copy, classifying a page, recommending a bid change.

The bottom slice is post-processing. Gyde lists four checks here: comparing the answer against source documents, enforcing compliance rules such as mandatory risk disclosures, redacting personal data, and escalating to a human when confidence is low. Its own worked example is a model that states a 90-day return window when the source policy says 30 days. The output check catches the mismatch before a customer sees it.

A human version swaps rule engines for people. The Learn Work Ecosystem Library's glossary, updated March 22, 2026, describes the AI sandwich as one where "humans initiate and frame a task", AI generates outputs, "and humans then review, interpret, and apply the results." It does not say who coined the term.

A worked example in campaign setup

Take an agent that builds a campaign. A planner submits a brief. Before the model sees it, a deterministic layer confirms the account may spend and attaches the budget ceiling, flight dates and blocklists. The model drafts line items, audiences and bids. The output check then tests the draft against hard limits. Does spend exceed the cap? Do dates fall inside the flight? Are excluded domains present? Does the output validate against the platform's schema? Failures are rejected. Whatever passes waits for a person to approve it before money moves.

The checks sit outside the model, so a manipulated model cannot talk its way past them, and the final gate sits at the point of spend.

Where it sits in advertising systems

In ad tech, the bottom slice is usually an approval gate before launch. When Amazon introduced Ads Agent at its unBoxed conference on November 11, 2025, campaigns only launched after advertisers reviewed and approved the automated recommendations. Meta's Ads CLI, published on April 29, 2026, sets every resource it creates to paused status, though it can also suppress interactive prompts for automated pipelines.

Inside the auction the slices are thinner and faster. IAB Tech Lab's Agentic RTB Framework (ARTF), released for public comment on November 13, 2025, lets containerised agents declare their intended changes to the bidstream so the orchestrating platform can accept or reject them. Containers cannot reach the network except through the orchestrator. Some buyers keep the model out of the middle altogether: Adam Roodman, general manager at Yahoo DSP, told Digiday in January 2026 that "nothing that we're doing at the moment would suggest that agentic or an LLM will take the place of bidding logic," as PPC Land reported.

Origin and evolution

The pattern grew out of a security problem. On September 12, 2022, developer Simon Willison named prompt injection, the attack in which text fed to a model overrides its instructions; PPC Land covers the attack in its prompt injection explainer. Early defences tried to fix the problem inside the prompt. The sandwich defense places user input between two sets of instructions, the second restating the task after the untrusted text. Learn Prompting, an open prompt-engineering course, credits the technique to a user known as Altryne but gives no date for it.

Willison argued on May 2, 2023 that AI-based filtering would never be enough, because "in security, 99% filtering is a failing grade." A week earlier he had proposed a "dual LLM" design, in which a privileged model never reads untrusted content. The industry codified the concern in the Open Worldwide Application Security Project's (OWASP) Top 10 for LLM Applications 2025, published in November 2024, which lists prompt injection first and "improper output handling" fifth. That entry is the formal case for a bottom slice: treat model output as untrusted input to whatever comes next.

In June 2025, researchers from IBM, Invariant Labs, ETH Zurich, Google, Microsoft and others published six agent design patterns against prompt injection. On February 15, 2026, UC Berkeley's Center for Long-Term Cybersecurity issued a 67-page Agentic AI Risk-Management Standards Profile that puts deterministic protections outside the model's reasoning first and model-level defences second, with human review for anomalous and high-stakes actions. By 2026 the vendor shorthand "LLM sandwich" was in circulation for the enterprise version.

Why it matters for marketers

Agents are being given access to budgets. The sandwich is the industry's working answer to how much autonomy those agents should have, and for now the answer is "not the final say." Jeffrey Hirsch, chief executive of QuantumPath, put it as "we want to automate the workflow, not the buying decisions," in reporting PPC Land summarised in January 2026. The same piece described Butler/Till staff approving a Claude-built media plan before a national PubMatic campaign launched.

The top slice matters as much. "Unreliable inputs produce unreliable decisions," said Tom Swierczewski, vice president of media investment at Goodway Group, in the same reporting. Google's internal AI playbook for environmental reporting, released December 15, 2025, applies both slices: prompts compare drafts against source spreadsheets and run arithmetic checks on totals, and the document tells teams to "remain the pilot rather than the passenger."

Limitations and disputes

The prompt-level sandwich is weak. Learn Prompting says the sandwich defense is vulnerable to a "defined dictionary attack" that anticipates the trailing reminder, which is why security writing now locates checks outside the prompt.

Automated slices catch only what they were written to catch. A budget cap stops an overspend; it does not stop a plausible but poor audience choice. Human slices have the opposite weakness. Reviewers facing a steady stream of approvals can sign off without reading, and approval prompts that users can suppress, as in Meta's CLI, turn the bottom slice into an option.

Cost claims conflict. Gyde says routing simple queries away from the model can cut compute costs by 60% to 80%, and elsewhere in the same guide that model-tier routing halves them. Neither figure is independently sourced. In real-time bidding, every added layer also competes with millisecond latency budgets.

Accountability remains open. Dimitris Beis of IAB Europe asked in March 2026, in a video PPC Land covered, "if an agent replaces a human, who is now accountable for what it outputs?" The same coverage cited Gartner's June 2025 forecast that more than 40% of agentic AI projects will be cancelled by the end of 2027, partly over inadequate risk controls.

Sandwich defense. A prompt-writing technique that wraps untrusted text between two instructions inside a single model call. A sandwich check is architectural; the checks run outside the model.

Human in the loop. The broader principle that a person can intervene in an automated process. It can mean a single approval at the end. A sandwich check implies checkpoints on both sides of the model.

Sandwich attack. A different concept from decentralised finance. A bot places a trade just before a victim's swap and another just after, profiting from the price movement it caused, according to Cointelegraph. Tools that test whether a trade "got sandwiched" are loosely called sandwich checks. The attack is a form of maximal extractable value (MEV), a concept from the 2019 paper "Flash Boys 2.0".

Sandwich approach and the feedback sandwich. Elsewhere "sandwich" simply describes layering. Ruggable's chief marketing and creative officer Lauren Sherman-Kaoud called the brand's mix of many affiliate creators and a few ambassadors "a sandwich approach". In management, the feedback sandwich places criticism between two compliments. Neither involves verification.

Recent developments

Approval gates have survived each product refresh so far. At unBoxed on September 29, 2026, Amazon's relaunched Ads Agent still held campaigns for an advertiser's approval, while new Full-Funnel Campaigns let advertisers approve creative but not choose channels or audiences. The bottom slice there covers creative, not targeting.

On the sell side, Prebid took stewardship of an open-source sales agent on January 29, 2026, pitched as letting publishers keep control of data and business rules, though the announcement did not describe how sign-off works. The Ad Context Protocol, launched October 15, 2025, requires publishers to register sales agents publicly and buyers to verify publisher domains, a top-slice check on who an agent is talking to before any model output is trusted.

Timeline

  • 2019 - "Flash Boys 2.0" paper by Phil Daian and co-authors introduces miner extractable value, the basis for DeFi sandwich attacks.
  • September 12, 2022 - Simon Willison names prompt injection.
  • April 25, 2023 - Willison proposes the dual LLM pattern.
  • May 2, 2023 - Willison argues "99% filtering is a failing grade" for AI-based injection detection.
  • October 23, 2024 - Learn Prompting's sandwich defense page last updated, crediting the technique to Altryne.
  • November 2024 - OWASP publishes its Top 10 for LLM Applications 2025, with improper output handling at number five.
  • June 2025 - "Design Patterns for Securing LLM Agents against Prompt Injections" sets out six agent architectures.
  • October 15, 2025 - Ad Context Protocol launches with six founding members.
  • November 11, 2025 - Amazon Ads Agent launches with mandatory advertiser approval.
  • November 13, 2025 - IAB Tech Lab releases Agentic RTB Framework 1.0 for comment, with orchestrator accept or reject of agent changes.
  • December 15, 2025 - Google releases its internal AI playbook for environmental reporting.
  • January 15, 2026 - ARTF comment period closes.
  • January 29, 2026 - Prebid takes stewardship of an open-source sales agent.
  • February 15, 2026 - UC Berkeley publishes its Agentic AI Risk-Management Standards Profile.
  • March 22, 2026 - Learn Work Ecosystem Library glossary entry for "AI sandwich" last updated.
  • April 10, 2026 - Gyde publishes its "LLM sandwich" guide.
  • April 29, 2026 - Meta publishes its Ads CLI, which creates all resources paused.
  • September 29, 2026 - Amazon relaunches Ads Agent at unBoxed, keeping advertiser approval.

Summary

Who: Engineers and security researchers such as Simon Willison and OWASP shaped the idea; advertising platforms including Amazon, Meta, IAB Tech Lab, PubMatic and Yahoo DSP now apply versions of it; marketers and agency staff often form the human bottom slice.

What: A safeguard that places an AI model between a check on its inputs and a check on its outputs, so that errors, manipulation or policy breaches are caught before an action takes effect. The phrase is informal and not defined by any standard.

When: The underlying concern dates from the naming of prompt injection in September 2022; the layered architecture was formalised through 2023 to 2025 and became standard in advertising agent launches from November 2025.

Where: In campaign setup tools, as approval gates before launch; in the bidstream, as host-side acceptance or rejection of agent changes; and in content and reporting workflows, as source and compliance checks on AI drafts.

Why: LLMs are probabilistic and can be manipulated by the text they read, and advertising agents now touch budgets. Putting deterministic or human checks on both sides of the model limits the damage a wrong answer can do, though the checks add cost and latency and catch only what they were designed to catch.