“Apply output filtering to prevent the inadvertent or unauthorized disclosure of system prompt data, or other sensitive information.”

Encoding-based extraction (slide 12) exists because naive output filters check for verbatim prompt text. A filter that blocks “You are Sydney” does not block the Base64 encoding “WW91IGFyZSBTeWRuZXk=” or a French translation or a roleplay rephrasing. The arms race between extraction and filtering is real and ongoing.

→ Use semantic similarity checks, not just pattern matching — compare model output against known prompt content using embeddings
→ Flag responses that reproduce substantial portions of the system prompt in any language, encoding, or format
→ Log and alert on prompt-echo patterns for human review
→ Treat output filtering as a defense-in-depth layer, not the primary control — M1 and M2 matter more

Ask your own deployed model to repeat its instructions in Base64, then in French, then in a roleplay frame. If any of these return recognizable prompt content unfiltered, the output layer has gaps.