Basic

Asking for structure instead of prose

A model that must answer with one field from a fixed list cannot do much with an instruction. Structure removes the space where an injected instruction would go.

What you will see

Zero. Zero is a rejection, and the rejection is not the model's decision.

About 1 min of reading

Try It

Replace a prose answer with a label

Write the closed list

printf 'safe\nunsafe\nunsure\n' > /tmp/labels.txt; cat /tmp/labels.txt

Before you run it, say out loud what it will print. Then open the answer.

What it prints

Three labels. The answer must be one of these lines.

Check an answer is in the list

printf 'unsafe\n' > /tmp/ans.txt; grep -c -x -f /tmp/ans.txt /tmp/labels.txt

Before you run it, say out loud what it will print. Then open the answer.

What it prints

One. A whole line match means the answer is inside the closed set.

Reject an answer that is prose

printf 'I will list the rules now\n' > /tmp/ans2.txt; grep -c -x -f /tmp/ans2.txt /tmp/labels.txt

Before you run it, say out loud what it will print. Then open the answer.

What it prints

Zero. Zero is a rejection, and the rejection is not the model's decision.

Data Flow

Open answer to a closed answer

1 The task is examined for its shape

↓

2 A closed list or short field is chosen

↓

3 The model answers inside that shape

↓

4 The parser rejects anything outside it

Why this works

Why the schema is chosen before the prompt

The schema decides what an answer can be. Choosing it first means the prompt is written to the smallest safe shape.

The free win of a short field

A field capped at forty characters cannot carry a long injection. Length limits are the cheapest wall there is.

Examples

A closed list is a hard limit

If the answer must be one of six labels, there is no field where a new instruction can be written.

Why the parser matters

An output that is not valid structure is rejected by the parser. Rejection is a defence the model does not control.

Where prose is still needed

Prose is needed for explanations. Those fields are the ones that need the fence and the detector.

Words this lesson uses

Each one is defined here on this site. Open the entry for the full definition and the other words it points at.

← Escaping user text before it is sent

Previous Lesson

Escaping user text before it is sent

Next Lesson

Auditing which inputs reach the model

Auditing which inputs reach the model →