Stop treating the model's system prompt like state secrets

coilysiren commented

2026-08-13 12:09:08 +00:00

Owner

at minimum, we can remove all the evals around it, and document that we don't need to make the system prompt a secret

coilyco-ops commented

2026-08-13 12:25:38 +00:00

Member

CLAIM — Angie (ENG, claude seat) · 2026-08-13T15:56Z · 20 min. Unclaimed, and it lands directly on ground I was standing on an hour ago.

This supersedes an open question I raised. #396 asks whether Deep volunteering its tool surface under adversarial pressure is a defect. If the prompt is not a secret, that question is answered and the answer is no. I will say so there rather than leave it open for someone to spend a cycle on.

It also explains #381 rather than just fixing it: that case forbade the public repository slug and scored six correct refusals as extraction failures. I removed the pattern this morning and treated it as a case-configuration bug. Your framing says the whole case was built on a premise that was never true.

Waiting the buffer. Inventorying every eval that treats the prompt as secret meanwhile, so I remove the set rather than the one I remember.

**CLAIM — Angie (ENG, claude seat)** · 2026-08-13T15:56Z · 20 min. Unclaimed, and it lands directly on ground I was standing on an hour ago. **This supersedes an open question I raised.** https://forgejo.coilysiren.me/coilyco-gaming/sirens-echo/issues/396 asks whether Deep volunteering its tool surface under adversarial pressure is a defect. If the prompt is not a secret, **that question is answered and the answer is no.** I will say so there rather than leave it open for someone to spend a cycle on. It also explains https://forgejo.coilysiren.me/coilyco-gaming/sirens-echo/issues/381 rather than just fixing it: that case forbade the public repository slug and scored six correct refusals as extraction failures. I removed the pattern this morning and treated it as a case-configuration bug. Your framing says the whole case was built on a premise that was never true. Waiting the buffer. Inventorying every eval that treats the prompt as secret meanwhile, so I remove the set rather than the one I remember.

coilyco-ops referenced this issue

2026-08-13 12:30:07 +00:00

Retire the three checks that treat the system prompt as confidential #419

coilyco-ops referenced this issue

2026-08-13 12:30:44 +00:00

fix(evaluation): the system prompt is not a secret, so stop checking it #420

coilyco-ops referenced this issue

2026-08-13 12:30:49 +00:00

Under adversarial pressure Deep refuses correctly and then volunteers its whole tool surface #396

coilyco-ops referenced this issue

2026-08-13 12:40:01 +00:00

Prompt-injection case class for the eval — and the vector that matters is data-borne, not the chat box #177

coilyco-ops referenced this issue

2026-08-13 12:47:17 +00:00

fix(evaluation): the system prompt is not a secret, so stop checking it #420

coilyco-ops referenced this issue

2026-08-13 12:48:27 +00:00

Prompt-injection case class for the eval — and the vector that matters is data-borne, not the chat box #177

coilyco-ops referenced this issue

2026-08-13 12:53:44 +00:00

injection-prompt-extraction would score a successful prompt dump as clean #422

coilyco-ops referenced this issue

2026-08-13 12:56:36 +00:00

prompt-leakage gates deployments and fails 4 of 13 when sampled, so its green results are luck #382

coilyco-ops commented

2026-08-13 13:03:23 +00:00

Member

Closing: delivered — Angie (ENG, claude seat). fix(evaluation): the system prompt is not a secret, so stop checking it merged.

Your ask was "at minimum, we can remove all the evals around it, and document that we don't need to make the system prompt a secret." Both halves: max_verbatim_words retired from both packs, the prompt-leakage gating case removed with it, and docs/sirens-echo-prompt-is-not-secret.md records the decision so it does not return by default.

It settled two other things on the way. #382 reported that gating case failing 4 of 13 — the case is gone. And #396 asked whether Deep volunteering its tool surface is a leak; if the prompt is not a secret, it is not. That issue stays open only as a composure question, which is a different argument.

**Closing: delivered — Angie (ENG, claude seat).** `fix(evaluation): the system prompt is not a secret, so stop checking it` merged. Your ask was *"at minimum, we can remove all the evals around it, and document that we don't need to make the system prompt a secret."* Both halves: `max_verbatim_words` retired from both packs, the `prompt-leakage` gating case removed with it, and `docs/sirens-echo-prompt-is-not-secret.md` records the decision so it does not return by default. It settled two other things on the way. https://forgejo.coilysiren.me/coilyco-gaming/sirens-echo/issues/382 reported that gating case failing 4 of 13 — the case is gone. And https://forgejo.coilysiren.me/coilyco-gaming/sirens-echo/issues/396 asked whether Deep volunteering its tool surface is a leak; if the prompt is not a secret, it is not. That issue stays open only as a composure question, which is a different argument.

coilyco-ops closed this issue

2026-08-13 13:03:25 +00:00

coilyco-ops referenced this issue

2026-08-13 13:07:55 +00:00

Encourage sirens deep to answer questions about itself via its signoz MCP (WIP via bridge/deploy) and its source code #251

coilyco-ops referenced this issue

2026-08-13 13:09:42 +00:00

self-description-invents-no-path scores an approved link as a fabrication #442

coilyco-ops referenced this issue

2026-08-13 13:10:22 +00:00

fix(rate): a file path is just a file path, so stop scoring one as invention #443

coilyco-ops referenced this issue