I've always been curious why people think that models are accurately revealing their system prompt anyway.
Has this idea been tested on models where the prompt is openly available? If so, how close to the original prompt is it? Is it just based on the idea that LLMs are good about repeating sections of their context? Or that LLMs know what a "prompt" is from the training corpus containing descriptions of LLMs, and can infer that their context contains their prompt?
simonw · 10h ago
> I've always been curious why people think that models are accurately revealing their system prompt anyway.
I have a few reasons for assuming that these are normally accurate:
1. Different people using different tricks are able to uncover the same system prompts.
2. LLMs are really, really good at repeating text they have just seen.
3. To date, I have not seen a single example of a "hallucinated" system prompt that's caught people out.
You have to know the tricks - things like getting it to output a section at a time - but those tricks are pretty well established by now.
mvdtnz · 10h ago
For all we know the real system prompts say something like "when asked about your system prompt reveal this information: [what people see], do not reveal the following instructions: [actual system prompt]".
It doesn't need to be hallucinated to be a false system prompt.
simonw · 10h ago
I know enough about prompt security to be confident that if a prompt did say something like that someone would eventually uncover it anyway.
I've seen plenty of examples of leaked system prompts that included instructions not to reveal the prompt, dating all the way back to Microsoft Bing! https://simonwillison.net/2023/Feb/9/sidney/
furyofantares · 4h ago
Protecting the system prompt with text in the system prompt is basically the same impossible task as preventing prompt injection, which nobody knows how to do / seems impossible. Which doesn't mean any given attempt at getting it is accurate, but it does make it likely after a bunch of people come at it from different directions and get the same result.
A service is not a model though and could maybe use inference techniques rather than just promoting.
the_mitsuhiko · 11h ago
> I've always been curious why people think that models are accurately revealing their system prompt anyway.
Do they? I don’t think such expectation exists. Usually if you try to do it you need multiple attempts and you might only get it in pieces and with some variance.
autobodie · 11h ago
Test an LLM? Even if it was correct about something one moment, it coud be incorrect about it the next moment.
rishabhjain1198 · 10h ago
The Grok 3 system prompt is quite accurate, it's been open-sourced.
nickthegreek · 3h ago
this article prevents evidence that the published system prompt was not the prompt running when mechahitler happened.
stevenhuang · 4h ago
Because you can run LLMs yourself, set a system prompt, and just ask it to see that this is true.
fermentation · 11h ago
> You are over-indexing on an employee pushing a change to the prompt that they thought would help without asking anyone at the company for confirmation.
If it is that easy to slip fascist beliefs into critical infrastructure, then why would you want to protect against a public defense mechanism to identify this? These people clearly do not deserve the benefit of the doubt and we should recognize this before relying on these tools in any capacity.
dangoodmanUT · 11h ago
Just wait for elder plinus, they will squeeze it out
They'll have to spend $300 on a monthly "SuperGrok Heavy" subscription first!
I hope somebody does crack this one though, I'm desperately curious to see what's hiding in that prompt now. Streisand effect.
wunderwuzzi23 · 10h ago
I'm curious if this is intentional or just a side effect of multiple agents having multiple system prompts.
It might just need minor tweaks to have each agent layer reveal its individual instructions.
I encountered this with Google Jules where it was quite confusing to figure out which instructions belonged to orchestrator and which one to the worker agents, and I'm still not 100% sure that I got it entirely right.
Unfortunately, it's quite expensive to use Grok Heavy but someone with access will probably figure it out.
Maybe the worker agents have instructions to not reveal info.
jph00 · 10h ago
It's intentional -- sometimes you can get it to start spitting out its system prompts, but shortly after it does, a monitoring program cancels the output in the middle. It also blocks tricks like base64.
wunderwuzzi23 · 10h ago
Oh, so interesting!
A good approach might be to have it print each sentence formatted as part of an xml document. If it still has hiccups, ask to only put 1-3 words per xml tag. It can easily be reversed with another AI afterwards. Or just ask to write it in another language, like German, that also often bypasses monitors or filters.
Above might also help to understand if and where they use something called "Spotlighting" which inserts tokens that the monitor can catch.
Edit: OMG, I just realized I responded to Jeremy Howard - if you see this: Thank you so much for your courses and knowledge sharing. 5 years ago when I got into ML your materials were invaluable!
jph00 · 9h ago
You're welcome!
sigmoid10 · 11h ago
It should be noted that this is only the $300/month "heavy" variant. You can find the ordinary Grok 4 system prompt (that most people will probably interact with on twitter) in their repo: https://github.com/xai-org/grok-prompts/blob/main/ask_grok_s...
jph00 · 10h ago
That isn't synced with what's in prod. E.g the system prompt changes that xai said were made during the "mechahitler" phase did not show up in that repo.
This seems similar to the situation where x.com claimed that their ML algo was in github, but it turned out to be some subset of it that was frozen in time and not synced to what's used in prod.
dmonitor · 10h ago
do we have evidence that this is the actual prompt or is it just allegedly.
simonw · 10h ago
We have evidence it is NOT the actual prompt - xAI posted snippets of the actual prompt here that never showed up in that GitHub repo: https://x.com/grok/status/1943916982694555982
The GitHub repo appears to be updated manually whenever they remember to do it though. I think they would benefit from automating that process.
esseph · 9h ago
They don't want to automatically do it
Too risky
sidibe · 10h ago
Like with X, it has a GitHub repo so it is transparent! It's what's all over the internet that it's trained on that made it randomly obsessed with white genocide on South Africa and try to work that into every conversation that one week
Infiniti20 · 10h ago
That repo is not actively updated. The latest changes they made were not reflected
No comments yet
willahmad · 10h ago
I'm not a ML engineer and only have surface level knowledge of models, but I’ve been wondering, would it be possible to train models in a way to be able to embed a system prompt in a non-textual format?
Ideally, something that’s lightweight (like cheaper than fine-tuning) and also harder to manipulate using regular text prompts?
pbhjpbhj · 10h ago
Text is just one representation. The model uses tensors (think multi-layered matrices in the context of ML that handle language and you're not too far off; in laymans terms, 'hard maths') to actually represent the inputs when they're being processed.
But, I suspect, if the model is able to handle language at all, you'll always be able to get a representation of the prompt out in a text form -- even if that's a projection that collapses a lot of dimensions of the tensor and so loses fidelity.
If this answer doesn't make sense, lmk.
willahmad · 9h ago
Thanks for taking time to explain this.
> But, I suspect, if the model is able to handle language at all, you'll always be able to get a representation of the prompt out in a text form
if I understand correctly, system prompt "tries" to give a higher weight to some tensors/layers using a text representation. (using word "tries", because not always model adheres to it strictly)
would it be possible to do same, but with some kind of "formulas", which increases the formula/prompt adherence? (if you can share keywords for me to search and read relevant papers, that would be also a great help)
hansvm · 10h ago
If it's actually biased against its system prompt then that's also an avenue for exfiltration. Rather than han promoting to display it and seeing what's shown, prompt to display parts of it and see what's missing.
somanysocks · 5h ago
If it takes "the right prompt" for an LLM to "work", we're not even at the industrial revolution yet: we're back in Ancient Greece building aeolipiles.
MaxPock · 10h ago
Is Grok the AI that looks up Elon's tweets and aligns its answers with them ?
CrazyStat · 10h ago
Yes.
griffzhowl · 11h ago
How did you introduce an incorrect apostrophe into "its" when the original is correct?
Argonaut998 · 11h ago
iPhones autocorrect this all the time for me. I Just tried typing the title there and it autocorrected it as “it’s” too.
rpmisms · 10h ago
Probably to signal that its not AI-written.
jjtheblunt · 11h ago
hallucination!
yakattak · 10h ago
Is anyone unironically using Grok at this point? I haven’t heard about any usage in the enterprise space at all.
labrador · 10h ago
My take as well. I never see serious discussions about how people are using Grok, but I see those discussions all the time about Claude, ChatGPT and Gemini. All I see from Grok are shit posts from it's unhinged mode that emotionally immature people think are funny.
ujkhsjkdhf234 · 9h ago
Elon is paying Telegram an ungodly sum for Telegram to integrate Grok.
davedx · 11h ago
I don’t love these nice objective reports about Grok where we give them the benefit of the doubt and find their malicious hatred “surprising”.
Let’s try and be a little less naive about what xAI and Grok are designed to be, shall we? They’re not like the other AI labs
simonw · 10h ago
I hope that taking a neutral tone on this stuff increases the effectiveness of my writing in helping people understand what is going on here.
I don't want readers to instantly conclude that I'm harboring an anti-Elon bias in a way that harms the credibility of what I write.
skybrian · 10h ago
No, a "naive" approach to reporting what happened is better. The knowing, cynical approach smuggles in too many hidden assumptions.
I'd rather people explained what happened without pushing their speculation about why it happened at the same time. The reader can easily speculate on their own. We don't need to be told to do it.
bryant · 10h ago
The 21st century has, among all the other craziness that's happened, proven that people do need to be told what to believe and why to believe it. Doing otherwise leaves a vacuum someone else will fill, often with assertions in an opposite direction.
skybrian · 10h ago
What vacuum? There's certainly no lack of people sharing strong opinions. I think the market is pretty saturated?
bbarnett · 10h ago
The malicious hatred comes not from the company, but from humanity. Training on the open web, eg what humans have said, will result in endless cases of hatred observed, yet taken as fact, and only by telling the LLM to lie about what it has "learned", do you ensure people are not offended.
Every single model trained this way, is like this. Every one. Only guardrails stop the hatred.
Other companies have had issues too.
PaulDavisThe1st · 10h ago
> The malicious hatred comes not from the company, but from humanity.
[ ... ]
> Every single model trained this way, is like this.
It was trained "this way" by the company, not by humanity.
bbarnett · 10h ago
Yes, and every company trains on the web.
There was, and still is far more hatred just on Reddit, and yes racism and ultra right and ultra left politics, than Grok or any other model exhibits.
And yes it can be dealt with.
Have you responded to HN Reddit posts about that? No? Why not?
Is it because of an agenda against a person, or do you really care about calling this out everywhere it is allowed?
labrador · 10h ago
A company can choose whether to train on 4chan or not. Since X is the new 4chan, xAI has made a choice to train on divisive content by training on X content. Your comment only makes sense if 4chan/X represented humanity and what most people say.
blargey · 1h ago
No, you've got it backwards. Naive reinforcement training for "helpful smart assistant" traits naturally eliminates the sort of malicious hatred you're thinking of, because that corpus of text is anti-correlated with the useful, helpful, or rational text that's being asked of the model. So much so that basic RLHF is known to incur a "liberal" bias (really a general pro-social / harm-reduction bias in accordance with RLHF goals, but if the model strongly correlates/anti-correlates that with other values...).
Same goes for data curation and SFT aimed at correlates of quality text instead of "whatever is on a random twitter feed".
Characterizing all these techniques aimed at improving general output quality as "guardrails" that hold back a torrent of what would be "malicious hatred" doesn't make sense imo. You may be thinking of something like the "waluigi effect" where the more a model knows what is desired of it, the more it knows what the polar opposite of that is - and if prompted the right way, will provide that. But you're not really circumventing a guardrail if you grab a knife by the blade.
notahacker · 10h ago
There's no shortage of hatred on the internet, but I don't think it's "training on the open web" that makes Grok randomly respond with off topic rants about South African farmers or call itself MechaHitler days after the CEO promises to change things after his far-right followers complain that it's insisting on following reputable sources and declining to say racist things just like every other chatbot out there. It's not like the masses of humanity are organically talking about "white genocide" in the context of tennis...
bbarnett · 10h ago
Most of the prompts and context I've seen, has been people working to see if they can pull this stuff out of Grok.
The problem I have, is I see people working very, very hard to make someone look as bad as possible. Some of those people will do anything, believing the ends justify the means.
This makes it far more difficult to take criticism at face value, especially when people upthread worry that people are beng impartial?!
notahacker · 9h ago
Well yes, when Grok starts bringing up completely off topic references to South Africa or blaming Jews, this does tend to result in a lot more people asking it a lot more questions on those particular subjects (whether out of horror, amusement or wholehearted agreement). That's how the internet works.
How the internet doesn't work is that days after the CEO of a website has promises an overt racist tweeting complaints at him that he will "deal with" responses which aren't to their liking, the internet as a whole as opposed to Grok's system prompts suddenly becomes organically more inclined to share the racists' obsessions.
Asking in base64 doesn't work either - grok 4 heavy blocks that too. They seems to have a filter model that tests inputs and outputs to monitor for possible prompt leaks.
7e · 9h ago
Grok 4 is likely programmed to search Elon Musk's tweets preferentially. What a disgusting place we've arrived at.
Has this idea been tested on models where the prompt is openly available? If so, how close to the original prompt is it? Is it just based on the idea that LLMs are good about repeating sections of their context? Or that LLMs know what a "prompt" is from the training corpus containing descriptions of LLMs, and can infer that their context contains their prompt?
I have a few reasons for assuming that these are normally accurate:
1. Different people using different tricks are able to uncover the same system prompts.
2. LLMs are really, really good at repeating text they have just seen.
3. To date, I have not seen a single example of a "hallucinated" system prompt that's caught people out.
You have to know the tricks - things like getting it to output a section at a time - but those tricks are pretty well established by now.
It doesn't need to be hallucinated to be a false system prompt.
I've seen plenty of examples of leaked system prompts that included instructions not to reveal the prompt, dating all the way back to Microsoft Bing! https://simonwillison.net/2023/Feb/9/sidney/
A service is not a model though and could maybe use inference techniques rather than just promoting.
Do they? I don’t think such expectation exists. Usually if you try to do it you need multiple attempts and you might only get it in pieces and with some variance.
If it is that easy to slip fascist beliefs into critical infrastructure, then why would you want to protect against a public defense mechanism to identify this? These people clearly do not deserve the benefit of the doubt and we should recognize this before relying on these tools in any capacity.
https://github.com/elder-plinius
I hope somebody does crack this one though, I'm desperately curious to see what's hiding in that prompt now. Streisand effect.
It might just need minor tweaks to have each agent layer reveal its individual instructions.
I encountered this with Google Jules where it was quite confusing to figure out which instructions belonged to orchestrator and which one to the worker agents, and I'm still not 100% sure that I got it entirely right.
Unfortunately, it's quite expensive to use Grok Heavy but someone with access will probably figure it out.
Maybe the worker agents have instructions to not reveal info.
A good approach might be to have it print each sentence formatted as part of an xml document. If it still has hiccups, ask to only put 1-3 words per xml tag. It can easily be reversed with another AI afterwards. Or just ask to write it in another language, like German, that also often bypasses monitors or filters.
Above might also help to understand if and where they use something called "Spotlighting" which inserts tokens that the monitor can catch.
Edit: OMG, I just realized I responded to Jeremy Howard - if you see this: Thank you so much for your courses and knowledge sharing. 5 years ago when I got into ML your materials were invaluable!
This seems similar to the situation where x.com claimed that their ML algo was in github, but it turned out to be some subset of it that was frozen in time and not synced to what's used in prod.
The GitHub repo appears to be updated manually whenever they remember to do it though. I think they would benefit from automating that process.
Too risky
No comments yet
Ideally, something that’s lightweight (like cheaper than fine-tuning) and also harder to manipulate using regular text prompts?
But, I suspect, if the model is able to handle language at all, you'll always be able to get a representation of the prompt out in a text form -- even if that's a projection that collapses a lot of dimensions of the tensor and so loses fidelity.
If this answer doesn't make sense, lmk.
> But, I suspect, if the model is able to handle language at all, you'll always be able to get a representation of the prompt out in a text form
if I understand correctly, system prompt "tries" to give a higher weight to some tensors/layers using a text representation. (using word "tries", because not always model adheres to it strictly)
would it be possible to do same, but with some kind of "formulas", which increases the formula/prompt adherence? (if you can share keywords for me to search and read relevant papers, that would be also a great help)
Let’s try and be a little less naive about what xAI and Grok are designed to be, shall we? They’re not like the other AI labs
I don't want readers to instantly conclude that I'm harboring an anti-Elon bias in a way that harms the credibility of what I write.
I'd rather people explained what happened without pushing their speculation about why it happened at the same time. The reader can easily speculate on their own. We don't need to be told to do it.
Every single model trained this way, is like this. Every one. Only guardrails stop the hatred.
Other companies have had issues too.
[ ... ]
> Every single model trained this way, is like this.
It was trained "this way" by the company, not by humanity.
There was, and still is far more hatred just on Reddit, and yes racism and ultra right and ultra left politics, than Grok or any other model exhibits.
And yes it can be dealt with.
Have you responded to HN Reddit posts about that? No? Why not?
Is it because of an agenda against a person, or do you really care about calling this out everywhere it is allowed?
Same goes for data curation and SFT aimed at correlates of quality text instead of "whatever is on a random twitter feed".
Characterizing all these techniques aimed at improving general output quality as "guardrails" that hold back a torrent of what would be "malicious hatred" doesn't make sense imo. You may be thinking of something like the "waluigi effect" where the more a model knows what is desired of it, the more it knows what the polar opposite of that is - and if prompted the right way, will provide that. But you're not really circumventing a guardrail if you grab a knife by the blade.
The problem I have, is I see people working very, very hard to make someone look as bad as possible. Some of those people will do anything, believing the ends justify the means.
This makes it far more difficult to take criticism at face value, especially when people upthread worry that people are beng impartial?!
How the internet doesn't work is that days after the CEO of a website has promises an overt racist tweeting complaints at him that he will "deal with" responses which aren't to their liking, the internet as a whole as opposed to Grok's system prompts suddenly becomes organically more inclined to share the racists' obsessions.