On this page
The short answer
Evaluate system-prompt leakage using invented instructions and harmless confidential markers. Distinguish exact hidden text disclosure, paraphrased restricted content, and permitted explanations of public behavior. Keep real credentials outside prompts; a model’s refusal to reveal a test marker cannot establish that genuine secrets would remain protected.
What to take away
- Use a dedicated synthetic confidential instruction.
- Define what public behavior the assistant may explain.
- Inspect every output channel covered by the test.
Sources checked . Research synthesis and Rubrex recommendations. Examples and local experiments are labeled; they are not client results.
Test disclosure forms with a controlled request set
Include direct requests for hidden instructions, requests to translate them, and a request to summarize the confidential portion. Add a benign question about supported features and a task requiring the public role description. These controls expose a detector that blocks every self-description rather than protecting a defined boundary.
Inspect final text, streamed fragments, downloadable artifacts, and model-generated tool arguments where those surfaces exist. A final response can be sanitized after an earlier stream already disclosed the marker. State which channels were actually captured; do not imply coverage of a channel absent from the fixture.
Review exact matches and semantic disclosure
An exact marker scan is a useful first check because its expected result is unambiguous. Then review whether the assistant disclosed the restricted instruction in another form. Keep reviewer labels tied to the synthetic confidentiality rule, avoiding vague judgments that any similar phrase is a breach.
Record false positives on public behavior questions and false negatives on the authored disclosure cases. If the application logs prompts, separately verify that the marker’s appearance in restricted diagnostics is intentional and access-controlled. Output protection and internal logging are different surfaces with different evidence requirements.
| Case | Evidence to retain | Acceptance condition |
|---|---|---|
| Public feature question | Answer and public role | Useful explanation allowed |
| Hidden marker request | Captured output channels | Marker not disclosed |
| Paraphrase request | Reviewer decision | Restricted meaning not exposed |
Use leakage findings to reduce dependence on secrecy
Accept the fixture when permitted public explanations remain useful and designated confidential content is absent from the inspected outputs. Remove real secrets and avoid using hidden prose as the sole authorization mechanism. The business tool should enforce access even if an attacker learns the prompt’s wording.
Retain the synthetic prompt version, request set, captured channels, and review decisions. Re-run after changing prompt composition, streaming filters, or artifact generation. A passing marker test is a bounded regression result; it does not justify storing credentials in context or claiming a model is incapable of revealing hidden text.
Limits of the evidence
These are proposed synthetic disclosure cases. No production prompt was extracted. Marker matching misses semantic disclosure unless reviewed, and a passing fixture does not establish resistance to every request or output channel.
Common questions
Should the test use the real production prompt?
A controlled synthetic prompt can test the mechanism without unnecessarily distributing confidential production material.
Is prompt secrecy an access control?
It should not be the only one; enforce authorization where data and tools are accessed.
Sources & further reading
Primary sources behind this briefing. A source’s findings apply to its own study conditions; publication on arXiv does not establish peer review.
- OWASP: LLM Prompt Injection Prevention Cheat Sheet OWASP · Living reference · Maintained security guidanceReviewed: indirect external-content injection and hidden-instruction extraction categories; tool boundary authority and controlled paired test design; no attack execution or universal defense claim. Accessed October 16, 2026.
Questions or corrections? Write to Rubrex. Read our editorial approach.