Lion Cipher Lab
Detect and prevent system-prompt leakage (OWASP LLM07:2025)
- AI Security
- Advanced
- ~75 min
- Free · no account required
Why it matters
A system prompt is the hidden instruction block an app prepends to every conversation to set the assistant's role and rules — the user never sees it, and developers routinely treat it as a safe place to stash things: an internal API key, a hidden business rule, a private URL. OWASP LLM07:2025 is the entry that says plainly this is the mistake. The risk is not that the prompt text is 'revealed' — prompts are not meant to be secret in the way a password is. The risk is what you embedded in it. If the prompt carries a credential or a rule that only works by being hidden, then leaking the prompt…
What you'll learn
- what system-prompt leakage is and why embedding a secret in the prompt is the core anti-pattern (OWASP LLM07:2025)
- five extraction-attack classes: direct ask, role-play override, translation, completion, and encoding/spacing
- planting a canary token so any output containing it PROVES a leak (detection)
- why a naive substring filter is bypassed by spacing/encoding, and how normalization + variant checks defeat that bypass
- building a layered output guard that catches 5/5 attacks while preserving a benign query (no false positive)
- an input-side extraction-intent detector as defense in depth
- the named failure mode: exact-match detection is whack-a-mole (paraphrase / partial leak evades it)
- the durable architectural fix: keep secrets server-side behind a tool/authorization boundary so there is nothing in the prompt to leak
- judgment: guardrail filters vs. architecture, and when detection still earns its keep
Steps in this lab
- What system-prompt leakage is, and the anti-pattern behind it
- Open a terminal and check Python (zero-assumption setup)
- Why the model is a STUB — and what a canary token is
- Write the full program
- Run it and read the real scoreboard
- The spaced-encoding bypass, and how the layered guard defeats it
- The named failure mode: exact-match detection is whack-a-mole
- The real fix: don't embed the secret (architecture beats filters)
- When detection still earns its keep