Lumo System Bio
Overview (confidence: high)
Lumo implements the strongest prompt-injection defense in the corpus using a system_bio parameter — an architecture-level immutable field outside the conversation context. This represents a Level 3 defense in the anti-prompt-injection taxonomy.
Envelope Format (confidence: high)
Plain markdown with section headers (##), consistent with developer-facing tools. The envelope format is secondary to the architectural innovation of the system_bio parameter.
System Bio Defense (confidence: high)
The system_bio field is a separate, immutable part of the model’s context. Key properties:
- Cannot be overwritten by conversation tokens
- Configured at the architecture level, not just with instructions
- Represents the only Level 3 defense in the corpus
- Instruction-level refusal (Level 1) is also present as a fallback
This approach solves the fundamental vulnerability of instruction-based defenses: user messages cannot overwrite architecture-level fields.
Comparison with Other Defenses (confidence: high)
| Level | Approach | Example Tool |
|---|---|---|
| 1 | Instruction-only refusal | ~20 tools |
| 2 | Decoy-based | codebuddy-anti-spill |
| 3 | Architecture-level | Lumo |
| 4 | Constitutional AI | anthropic-tool-use-api |
Implications (confidence: high)
Lumo’s system_bio approach represents the only Level 3 defense in the corpus. By making the prompt immutable at the architecture level, it solves the fundamental vulnerability of instruction-based defenses: user messages cannot overwrite architecture-level fields.
Sources
- [raw/prompts/articles/taxonomy-synthesis-2026-07-16.md]