In this case it could be solved by not letting the LLM consume the transaction message. Effectively the same as preventing user supplied info going to the first argument of printf().

The transaction in question can remain opaque to the LLM and a %transaction.message% string is resolved in the layer between the LLM and the user.