“Decouple the processing of sensitive information from the language model itself, using more traditional backend systems for tasks that require high levels of data security or confidentiality.”

The GitHub Copilot extraction (slide 11) exposed internal tool descriptions and function signatures because they lived in the model’s context. The model needed them to describe its capabilities — but by embedding them, it made them extractable. The same logic that drives capability also drives disclosure.

→ The model’s job is to understand intent and route requests — not to hold the full specification of every backend service
→ Tool descriptions in the prompt should describe behavior at a user-facing level, not expose internal API structures
→ Business rules are enforced by backend validation; the model is told “route this to the billing service” not “here are the billing rules”
→ Sensitive computation happens outside the context window the model can read

List everything in your system prompt. For each item, ask: does this need to be in the prompt, or could a backend service handle it? Every item that moves out of the prompt is one less thing that can be extracted.