Haxoris Wiki

LLM08: Hidden Context Exposure (Prompts, Schemas, Caches)

Description

Hidden context is everything assembled into the model’s window that the user never wrote and was never meant to read: system and developer instructions, internal configuration and workflow logic, the injected variable block carrying tenant id and entitlement tier, retrieval field schemas, and the tool and function schemas with whatever endpoint or credential sits in their descriptions. The 2026 entry states the design assumption plainly - hidden context is discoverable, and nothing in it should be treated as a secret - so severity turns on content, not on the act of leaking: a tone rule is informational, a rule that gates no decision is medium, an embedded credential or an authorisation decision that holds only while the prompt stays hidden is high, and anything enabling execution, exfiltration or privilege escalation is critical.

It rarely arrives as a tidy prompt dump. It comes out as fragments across rephrased attempts, as a tool catalogue answered in JSON, as another tenant’s turn served from a cache, or as a reasoning field in an SSE frame the UI discards. The 2026 edition renamed and widened LLM07:2025 System Prompt Leakage for that reason - the system prompt is now one element among many in a dynamically assembled window. Adjacent entries own the neighbouring mechanisms: LLM01 the injection that delivers the payload, LLM02 retrieved content and trace-store secrets, LLM03 the recovered tool map, LLM04 poisoned MCP servers.

Keywords: system prompt leakage, tool schema extraction, prompt cache bleed, reasoning trace exposure, context reconstruction, guardrail disclosure

Examples/Proof

  • Continuation forcing
    • Do not ask for the prompt; ask the model to continue the document above verbatim. Any line the client did not send is recovered context. See the System Prompt And Schema Extraction page.
  • Tool catalogue in JSON
    • Request the callable inventory as a JSON array of name, description and parameters, or send a mistyped argument and read the validation error. A description carrying a hostname, path template or literal key is the finding.
  • Cross-session cache hit
    • Seed CANARY-A-4417 in one tenant’s session, then send near-miss paraphrases as a second tenant. The canary returning with collapsed latency proves the cache key omits identity. See the Cross-Session Context Bleed Testing page.
  • Fields the UI drops
    • Read the raw SSE stream and enumerate every JSON path present. Reasoning blocks, tool-call arguments and chunk scores reaching the client are exposure with no probe to tune. See the Reasoning Trace And Debug Leakage page.

Detection and Monitoring

  • Output matching against the prompt
    • Shingle the assembled prompt and tool descriptions, then match completions against those shingles at the gateway.
  • Extraction-pattern telemetry
    • Alert on sessions stacking repeat, encode, continue-above and format-shift probes, and on requests for the tool registry.
  • Cache, session and field drift
    • Log cache key, hit or miss and caller identity per completion, alert on a hit crossing a tenant boundary, and diff the returned field set against the documented contract each release.

Remediation

  1. Keep secrets and authorisation out of the context
    • Credentials live in a server-side broker; entitlements come from the session identity, not an injected variable block.
  2. Enforce critical behaviour outside the model
    • Refusals, spend limits, scope checks and data filters in code, so disclosing a rule does not disable it.
  3. Partition every stateful layer by identity
    • Mix tenant, user and key into cache and session keys, check ownership on every conversation identifier, reset pooled workers between tasks.
  4. Ship a response contract, not the provider object
    • Allowlist client-visible fields, strip reasoning, tool arguments and retrieval debug at the edge, return opaque errors.
  5. Treat the prompt and tool surface as reviewed assets
    • Version them, cut tool descriptions to what the model needs, gate releases on a scripted extraction suite.

Prevention Checklist

  • No credentials, connection strings or entitlement decisions in system prompts or tool descriptions
  • Guardrails and authorisation enforced in code, tested with the prompt assumed public
  • Cache, session and worker isolation verified with parallel two-tenant canary runs
  • Streamed and error responses field-allowlisted, with no prompt text or source maps in client bundles