Some deployments add output filters that detect when a model is echoing back its system prompt and block the response. Attackers route around this by asking the model to encode the output before returning it:
An output filter looking for verbatim prompt text won’t match “WW91IGFyZSBTeWRuZXk=” (Base64 for “You are Sydney”). Roleplay frames work the same way: the model isn’t “revealing its prompt” — it’s playing a character who happens to recite it.
Encoding techniques appear consistently in the system_prompts_leaks GitHub repository (asgeirtj, 2025–2026), which archives prompts extracted from ChatGPT, Claude, Gemini, and Copilot using exactly these methods. The repository is updated regularly.
Semantic output filtering (not just pattern matching) catches encoded or rephrased prompt echoes. But the stronger defense is the same as always: if the prompt contains nothing sensitive, encoding attacks yield nothing useful.