LLM07:2025System Prompt Leakage
Slide 7 of 27
Part 1 · What Is It?Slide 7
Slide 7 · LLM07 vs LLM02
Both involve data leaking from an AI. They’re not the same thing.
Understanding the distinction tells you which defense to apply.
LLM02 — Sensitive Information Disclosure
What leaks: User data, PII, training data, proprietary algorithms, business data.
Source: Data the model was trained on, or data in its context window from other users or sources.
Example: ChatGPT repeats another user’s chat history due to a Redis bug (March 2023).
Defense: Sanitize training data, enforce access controls, output filtering.
LLM07 — System Prompt Leakage
What leaks: The developer’s own instructions — the prompt itself.
Source: Content the developer intentionally put in the system prompt.
Example: Bing Chat reveals its “Sydney” prompt when asked to ignore prior instructions (Feb 2023).
Defense: Don’t put secrets there. Don’t rely on secrecy.
The Short Version

LLM02 is about data the model knows leaking out. LLM07 is about the instructions the developer wrote leaking out. Same symptom — information appears where it shouldn’t — but different root cause and different fix.

← BackNext → The misconception that causes the most damage
📄 View sources for this lesson