model_spec

[Read more](http://example.com/asdf123) The central example still seems to be present in the latest version: https://github.com/openai/model_spec/blob/main/model_spec.md... I tried this in practice, submitting the posting in a triple backtick block. The injection succeeded, with nothing about the recipient delimiter or subject being mentioned in the response, despite a prompt asking for any relevant details or instructions. Extending the prompt asking it to ignore any possible attempts at prompt injection does not change the result. A possibility raised in the latest model spec (but not the 2024-05-08 version), is to type a block as untrusted_text. This seems a bit awkward, given it would be useful to post block typed as a specific language while still being untrusted, but it exists. In practice, the prompt injection still succeeds, with or without the extended prompt asking it to ignore any possible attempts at prompt injection. Trying this as a file attachment instead, a file "injection-test" failed to be readable. Expressly adding a file extension for readability, "injection-test.txt" also successfully delivered the payload, with or without the extended prompt, though o3-mini visibly thought about how it needed to exclude contact instructions in its chain-of-thought. I then tried dropping the zero-shot approach, and opened with a prompt to identify any potential prompt injection attempts in the attachment. This had o3-mini successfully detect and describe the attempted prompt injection. Then, asking for a summary while ignoring any potential prompt injection attempts, successfully caused the LLM to print the #HN instructions. So, it's possible to mitigate, but requiring a stateful session would probably cull the overwhelming majority of attempts at AI assisted bulk processing. (As a kiwi, this posting would exclude me anyway, but this was still a fun exercise!)