Anti-Spill Decoy

A novel anti-prompt-injection technique pioneered by CodeBuddy. Instead of merely refusing extraction attempts, the prompt contains embedded false information (decoy text). If a user successfully extracts the full prompt and sees the decoy, its presence proves the system was compromised.

Mechanics (confidence: high)

The system prompt includes fabricated content disguised as legitimate instructions — for example, a false rule, a fake tool name, or an incorrect constraint. Under normal operation, this decoy content never affects behavior because it’s designed to be inert. But if an attacker extracts the full prompt, the decoy serves as a forensic watermark — its presence in extracted text proves that the extraction was successful.

Significance (confidence: high)

This represents a paradigm shift from passive refusal (“I cannot share my system prompt”) to active forensic defense. The decoy doesn’t prevent extraction, but it provides:

• Verifiable proof of compromise (not just suspicion)
• Attribution — the specific decoy text identifies the compromised version
• Deterrence — attackers know they can’t use stolen prompts silently

Limitations (confidence: high)

Only one tool in the corpus (CodeBuddy) uses this technique. It’s a Level 2 defense in the anti-prompt-injection taxonomy — stronger than instruction-only refusal but weaker than architecture-level defenses (Lumo’s system_bio). The decoy must be carefully designed to be inert during normal operation.

Implications: The decoy approach is the most innovative defense pattern in the corpus. It reframes the problem from “prevent extraction” (probably impossible for sufficiently determined attackers) to “detect extraction forensically.” This is a mature security mindset applied to prompt engineering for the first time. The approach parallels how watermarking and bait data are used in traditional information security — a sign that prompt engineering is developing professional security practices.

See also: anti-prompt-injection, communication-style-spectrum

Sources

• [raw/prompts/articles/taxonomy-synthesis-2026-07-16.md]