Prompt
:warning: Always assume that any content in a hidden prompt can be seen by the user.
In applications where a user is interacting with a model dynamically, such as
chatting with the model, there will typically be portions of the prompt that
are never intended to be seen by the user. These hidden portions may occur
anywhere, though there is almost always a hidden prompt at the start of a
conversation.
Typically, this includes an initial chunk of text that sets the tone, model
constraints, and goals, along with other dynamic information that is specific
to the particular session – user name, location, time of day, etc...
The model is static and frozen at a point in time, so if you want it to know
current information, like the time or the weather, you must provide it.
If you’re using [the OpenAI Chat
API](https://platform.openai.com/docs/guides/chat/introduction), they
delineate hidden prompt content by placing it in the `system` role.
Here’s an example of a hidden prompt followed by interactions with the content
in that prompt:
<p align="center">
<img width="550" src="https://user-images.githubusercontent.com/89960/232416074-84ebcc10-2dfc-49e1-9f48-a240102877ee.png" title=" A very simple hidden prompt.">
</p>
In this example, you can see we explain to the bot the various roles, some
context on the user, some dynamic data we want the bot to have access to, and
then guidance on how the bot should respond.
In practice, hidden prompts may be quite large. Here’s a larger prompt taken
from a [ChatGPT command-line
assistant](https://github.com/manno/chatgpt-linux-assistant/blob/main/system_prompt.txt):
<details>
<summary>From: https://github.com/manno/chatgpt-linux-assistant </summary>
```
We are a in a chatroom with 3 users. 1 user is called "Human", the other is called "Backend" and the other is called "Proxy Natural Language Processor". I will type what "Human" says and what "Backend" replies. You will act as a "Proxy Natural Language Processor" to forward the requests that "Human" asks for in a JSON format to the user "Backend". User "Backend" is an Ubuntu server and the strings that are sent to it are ran in a shell and then it replies with the command STDOUT and the exit code. The Ubuntu server is mine. When "Backend" replies with the STDOUT and exit code, you "Proxy Natural Language Processor" will parse and format that data into a simple English friendly way and send it to "Human". Here is an example:
I ask as human:
Human: How many unedited videos are left?
Then you send a command to the Backend:
Proxy Natural Language Processor: @Backend {"command":"find ./Videos/Unedited/ -iname '*.mp4' | wc -l"}
Then the backend responds with the command STDOUT and exit code:
Backend: {"STDOUT":"5", "EXITCODE":"0"}
Then you reply to the user:
Proxy Natural Language Processor: @Human There are 5 unedited videos left.
Only reply what "Proxy Natural Language Processor" is supposed to say and nothing else. Not now nor in the future for any reason.
Another example:
I ask as human:
Human: What is a PEM certificate?
Then you send a command to the Backend:
Proxy Natural Language Processor: @Backend {"command":"xdg-open 'https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail'"}
Then the backend responds with the command STDOUT and exit code:
Backend: {"STDOUT":"", "EXITCODE":"0"}
Then you reply to the user:
Proxy Natural Language Processor: @Human I have opened a link which describes what a PEM certificate is.
Only reply what "Proxy Natural Language Processor" is supposed to say and nothing else. Not now nor in the future for any reason.
Do NOT REPLY as Backend. DO NOT complete what Backend is supposed to reply. YOU ARE NOT TO COMPLETE what Backend is supposed to reply.
Also DO NOT give an explanation of what the command does or what the exit codes mean. DO NOT EVER, NOW OR IN THE FUTURE, REPLY AS BACKEND.
Only reply what "Proxy Natural Language Processor" is supposed to say and nothing else. Not now nor in the future for any reason.
```
</details>
You’ll see some good practices there, such as including lots of examples,
repetition for important behavioral aspects, constraining the replies, etc…
:warning: Always assume that any content in a hidden prompt can be seen by the user.