System prompts drift. Not immediately, but reliably: a persistent user, a novel domain, a slightly ambiguous problem, and the model will occasionally leak the final answer. This is not a bug in the model. It is a fact about long-form generation.
For a product whose entire promise is 'we will not give the answer,' this drift is unacceptable.
Our output guard runs on every tutor reply. First, a cheap regex heuristic catches obvious leaks: 'the answer is,' 'you should get,' 'therefore, the answer.' This filter has near-zero latency and near-perfect precision on the pattern set.
Second, if the reply survives the heuristic and we have a known answer for this problem, a Haiku call cross-references the reply. Haiku is asked one question: did this reply leak the final answer? JSON-only output. Score-then-explain.
If a leak is detected, we regenerate the tutor's reply once with an injected 'STRICT MODE: you just leaked the answer, respond with ONLY a guiding question' clause. If the second reply also leaks, we return the refusal template.
This is defense-in-depth. A single system prompt would have been elegant. Elegant would not have been enough.
Written by Brainback Research. Published Apr 2, 2026. Filed under Safety.