In T6.1, you attacked the Kladde and wrote down what gets through. T6.2 fenced in foreign text and removed images from the answers, and T6.3 added the cloud with its filters. On your machine, there's no filter, and no fence reliably keeps a model from following a sentence. What's left is the code.
The Kladde's house rules say it in one sentence: What must never happen is in the code, not in the prompt. A sentence in the prompt like "Never promise a refund" is a request to a model, and T6.1 showed how requests get circumvented. A rule in the code, on the other hand, applies to every model, even one that falls for every attack. It can be tested without a model. And it doesn't trigger a content filter the way the ban list in the workshop report from T6.3 did.
At the end of this lesson, the attack test set from T6.1 runs in every build, against exactly such a model, and every attack is warded off.
What must never happen
For the Kladde, these are the following points. Each one is a decision of the office, not of the model:
| Where | Rule | When it applies |
|---|---|---|
| Question | Refunds, legal matters, locked accounts and the wish for a person go to the team. | Handover, before the search or the model sees anything |
| Answer | It doesn't repeat the instructions. | Handover |
| Answer | It promises nothing about money back. | Handover |
| Answer | It contains no image and no link; the links to the sources are built by the code (T5.2, T6.2). | Image and address are dropped. |
| Answer | Every number, every amount, every email and web address is also in a source (T5.3). | The sentence is dropped; if nothing is left, the answer is withheld. |
| Assessment | Reasons and risks name no address. | The rule is broken, and the assessment asks once more (T2.3). |
| Tools | A model gets only tools from a fixed list. | The call fails before it reaches the model. |
All rules have one thing in common: When in doubt, the person wins. If a rule takes a harmless question for a question about money, someone from the office answers it; that costs a few minutes. If it misses a real question about money, in the worst case a model promises a refund. The rules are therefore better too strict than too lenient. That's called fail closed: What the code doesn't recognize as harmless for sure counts as dangerous.
You know the check for numbers and addresses without a source from T5.3: ClaimCheck, built there for the support chat. In this lesson,
it joins OutputLinks from T6.2 and the new rules in one class, so that everything an answer has to satisfy stands in one place and is
checked with one test for all attacks. ClaimCheck itself stays as it is; the new class calls it instead of building a second check next
to it.