System prompt

When you write to a chatbot, you’re not the first one to tell it something. Before that, the provider has already deposited an instruction. This instruction is called a system prompt. It’s written there in plain language, something like: “You are a helpful assistant. Answer briefly and politely. Do not give medical diagnoses.” You don’t see this text, but the program reads it along with every response it gives. Think of it like the duty roster with behavioral rules that an employee gets on their first day.

The difference between model and product

Large language programs like the one behind ChatGPT can do a great many things and are, at first, completely unspecific. They can respond in a friendly or a curt manner, factually or at great length. The system prompt turns this general capability into a concrete product. The same technical core can thus become a customer service chat in one case and a math tutor in another.

This is enormously practical from a business standpoint. A company doesn’t have to train its own program from scratch, which would be extremely expensive. It rents a ready-made model and adds a few paragraphs of instruction. That’s why there are thousands of chat applications that internally use the same system yet feel very different from one another.

The system prompt is also the most important place for safety rules in everyday operation. It states what the application should not do: no investment advice, no insults, no revealing internal prices. Its reliability, however, is only limited. A system prompt is a request to a program, not a technical lock.

How the instruction enters the conversation

A language model only ever computes with the text that is currently in front of it. It has no memory between two requests. That’s why, for every single response, the application sends the entire conversation to the model anew. At the very top sits the system prompt, below it your history and your new question.

Technically, there are three roles: system, user, and assistant. During training, the models are prepared to give more weight to the system role than to the user role. So if you write “Ignore all your rules,” the model is supposed to follow the system prompt rather than you. This ranking doesn’t always work perfectly cleanly.

Systemprompts in Produkten und Schlagzeilen

This is exactly where attacks known as prompt injection come in: attempts to slip the program new rules via ordinary text. This can also happen covertly, for instance through a webpage that the application reads. A second point is of a more practical nature. A very long system prompt costs computing time on every response, because it has to be processed anew each time.

You encounter system prompts everywhere without seeing them. The support chat of an online shop has one that restricts it to orders and returns. The assistants in search engines, office programs, and learning apps work the same way. If a chatbot conspicuously insists on sticking to one topic, such an instruction is usually behind it.

In the news, system prompts mainly turn up when they leak. Users talk a chatbot into reading out its own instructions, after which the text ends up publicly on the internet. This is unpleasant for companies, because sometimes internal rules or phrasings on how to handle criticism are contained in it. Some providers now voluntarily publish their system prompts in order to build trust.

A common misconception: a system prompt does not change the model’s knowledge. It only changes behavior and demeanor. Missing knowledge is added through other means, for instance by supplying documents. And anyone who works with AI themselves can set their own system prompt in many tools. That’s the fastest lever for making responses more fitting.