Walk me through detecting and mitigating an indirect prompt injection in a RAG system.

Detection: (1) anomaly detection on retrieved chunks (statistical outliers in token distribution); (2) semantic classifiers flagging adversarial intent in retrieved content; (3) output validation (does response match expected format/schema?); (4) provenance tracking (which document caused which response token?). Mitigation: (1) strict input/output schemas; (2) separate retrieval from generation context; (3) adversarial training with known prompt injection corpora; (4) human-in-the-loop for high-risk responses; (5) sanitise retrieved content before context injection.