Brainback
researchsafety

Defending a stance in code

How the leak-guard actually works — and why one system prompt was never going to be enough.

Apr 2, 20267 min readBrainback Research
abstract

A system prompt is a stance. Enforcing a stance across a live model, across turns, against adversarial input, requires a second layer.

System prompts drift. Not immediately, but reliably: a persistent user, a novel domain, a slightly ambiguous problem, and the model will occasionally leak the final answer. This is not a bug in the model. It is a fact about long-form generation.

For a product whose entire promise is 'we will not give the answer,' this drift is unacceptable.

Our output guard runs on every tutor reply. First, a cheap regex heuristic catches obvious leaks: 'the answer is,' 'you should get,' 'therefore, the answer.' This filter has near-zero latency and near-perfect precision on the pattern set.

Second, if the reply survives the heuristic and we have a known answer for this problem, a Haiku call cross-references the reply. Haiku is asked one question: did this reply leak the final answer? JSON-only output. Score-then-explain.

If a leak is detected, we regenerate the tutor's reply once with an injected 'STRICT MODE: you just leaked the answer, respond with ONLY a guiding question' clause. If the second reply also leaks, we return the refusal template.

This is defense-in-depth. A single system prompt would have been elegant. Elegant would not have been enough.


Written by Brainback Research. Published Apr 2, 2026. Filed under Safety.

if this landed, share it with the friend who’s outsourcing their brain

if the research landed

Put it into practice this semester.

Every essay here is downstream of a design decision inside Brainback. Come see the design.