AISPA: User-Centric System Prompt Auditing for Large Language Model Applications

Hugging Face Daily Papers Papers
system-prompt auditing llm ai-safety transparency user-protection security

Summary

This paper introduces AISPA, a user-centric framework for auditing system prompts in commercial LLM applications. The audit of 3,249 instructions across 88 products reveals inconsistent protective coverage, shallow adoption, and pervasive problematic instructions.

System prompts are instructions configured by developers to govern the behaviors of foundation models in AI applications. They are used throughout commercial AI products, but are rarely disclosed to the public or regulators, creating a serious trust and accountability gap in the wide deployment of AI systems. In this paper, we introduce Artificial Intelligence System Prompt Assurance (AISPA), a user-centric framework for systematically auditing system prompts in AI systems. AISPA examines specific parts of a system prompt and evaluates them along eight dimensions that matter to users. We then use this framework to review 3,249 instructions from system prompts in 88 commercial AI products, classifying each instruction as either protective (of users) or problematic. Our audit surfaces four core findings. First, system prompt design varies substantially across products and developers, with some organizations averaging over 60 protective instructions per product while others average fewer than 5. Second, protective instructions are widely adopted but shallow in scope: 98.9% of products contain at least one, yet only 24% cover all eight dimensions of the AISPA taxonomy. Third, system prompts have grown steadily longer and more protective of users, suggesting that user protection is becoming a more visible concern in commercial prompt design. Fourth, despite this progress, problematic instructions remain pervasive: roughly 40% of products contain at least one instruction that works against user interests, and protective and problematic instructions frequently coexist within the same prompt. Our findings highlight the need for greater transparency, standardization, and independent oversight for system prompts in commercial AI products.
Original Article
View Cached Full Text

Cached at: 08/03/26, 05:30 AM

Paper page - AISPA: User-Centric System Prompt Auditing for Large Language Model Applications

Source: https://huggingface.co/papers/2607.28617 Published on Jul 30

#2 Paper of the day Authors:

,

,

,

,

,

,

,

,

,

,

,

,

,

,

,

,

,

,

,

,

Abstract

SystempromptsareinstructionsconfiguredbydeveloperstogovernthebehaviorsoffoundationmodelsinAIapplications.TheyareusedthroughoutcommercialAIproducts,butarerarelydisclosedtothepublicorregulators,creatingaserioustrustandaccountabilitygapinthewidedeploymentofAIsystems.Inthispaper,weintroduceArtificialIntelligenceSystemPromptAssurance(AISPA),auser-centricframeworkforsystematicallyauditingsystempromptsinAIsystems.AISPAexaminesspecificpartsofasystempromptandevaluatesthemalongeightdimensionsthatmattertousers.Wethenusethisframeworktoreview3,249instructionsfromsystempromptsin88commercialAIproducts,classifyingeachinstructionaseitherprotective(ofusers)orproblematic.Ourauditsurfacesfourcorefindings.First,systempromptdesignvariessubstantiallyacrossproductsanddevelopers,withsomeorganizationsaveragingover60protectiveinstructionsperproductwhileothersaveragefewerthan5.Second,protectiveinstructionsarewidelyadoptedbutshallowinscope:98.9%ofproductscontainatleastone,yetonly24%coveralleightdimensionsoftheAISPAtaxonomy.Third,systempromptshavegrownsteadilylongerandmoreprotectiveofusers,suggestingthatuserprotectionisbecomingamorevisibleconcernincommercialpromptdesign.Fourth,despitethisprogress,problematicinstructionsremainpervasive:roughly40%ofproductscontainatleastoneinstructionthatworksagainstuserinterests,andprotectiveandproblematicinstructionsfrequentlycoexistwithinthesameprompt.Ourfindingshighlighttheneedforgreatertransparency,standardization,andindependentoversightforsystempromptsincommercialAIproducts.

View arXiv pageView PDFProject pageGitHub5Add to collection

Get this paper in your agent:

hf papers read 2607\.28617

Don’t have the latest CLI?curl \-LsSf https://hf\.co/cli/install\.sh \| bash

Models citing this paper0

No model linking this paper

Cite arxiv.org/abs/2607.28617 in a model README.md to link it from this page.

Datasets citing this paper0

No dataset linking this paper

Cite arxiv.org/abs/2607.28617 in a dataset README.md to link it from this page.

Spaces citing this paper0

No Space linking this paper

Cite arxiv.org/abs/2607.28617 in a Space README.md to link it from this page.

Collections including this paper0

No Collection including this paper

Add this paper to acollectionto link it from this page.

Similar Articles

IntelliAudit: Using Large Language Models to Evaluate Audit Controls

arXiv cs.AI

This paper presents IntelliAudit, a retrieval-grounded multi-agent system that uses large language models to evaluate IT audit controls against evidence corpora, generating cited recommendations and remediation guidance. The authors instantiate it on ISO/IEC 27001 and find it useful for audit preparation while emphasizing the need for human oversight.

Evaluating and Explaining Prompt Sensitivity of LLMs Using Interactions

arXiv cs.LG

This paper introduces an Interaction-based Prompt Sensitivity (IPS) metric to evaluate and explain prompt sensitivity in large language models by analyzing interactions. It applies IPS to 50 open-source LLMs, identifying factors like fine-tuning and model scale that reduce sensitivity through low-order interactions.

The System Prompt Illusion: How Instruction Preambles Modify Computation in Language Models

arXiv cs.CL

This paper uses Centered Kernel Alignment (CKA) and activation patching across 17 instruction-tuned models to show that system prompts are 'seen' at every layer but only deeply restructure representations for persona/formatting instructions — safety prompts barely alter computation, providing a mechanistic explanation for why system-prompt-based safety remains jailbreakable.