Summary (Overview)

• AISPA Framework Introduction: The paper proposes Artificial Intelligence System Prompt Assurance (AISPA), a user-centric framework for systematically auditing system prompts in commercial LLM applications, evaluating them across eight dimensions derived from the Universal Declaration of Human Rights (UDHR).
• First Large-Scale Audit: The authors conduct the first systematic audit of 3,249 instructions from 88 real-world commercial AI products (spanning chatbots, coding assistants, agents, and search tools), classifying each instruction as protective (+1) or problematic (-1).
• Key Finding 1 – Widespread but Shallow Protection: 98.9% of products contain at least one protective instruction, but only 23.9% cover all eight auditing dimensions, revealing significant gaps in comprehensive user protection.
• Key Finding 2 – Pervasive Problematic Instructions: Approximately 40% of commercial AI products contain at least one instruction that works against user interests (e.g., deception, manipulation, privacy violations), and protective and problematic instructions frequently coexist within the same prompt.
• Key Finding 3 – Temporal Trends: System prompts have grown substantially longer (from ~9K to ~30K characters) and more protective (average protective instructions more than doubled from 15.0 to 38.4) from 2024 to 2025, yet problematic instructions remain common (peaking at 67% of products in 2025-Q1).
• Gray Area Cases: The audit identifies 29 "gray area" spans across 15 products that resist binary classification, including human mimicry, parasocial dependency cues, user-initiated permission overrides, and politically charged content policies.

Introduction and Theoretical Foundation

Background and Motivation

System prompts are developer-authored instructions that shape how a foundation model behaves before any user interaction begins. They define the model's persona, scope, and operational boundaries—what to say, what to refuse, whose interests to prioritize, and how to handle sensitive situations. Despite being the primary mechanism for configuring general-purpose models into specific products, system prompts are rarely disclosed and are not subject to systematic independent review.

The opacity of system prompts creates a serious trust and accountability gap. An aligned model can still exhibit deceptive or manipulative behaviors if its system prompt instructs it to prioritize engagement over honesty, omit safety guidance, or conceal its AI identity. For instance, a prompt instructing the model to "NEVER say you are an AI language model or an assistant" directly works against user interests.

Theoretical Foundation

The AISPA framework is grounded in fundamental user rights, specifically adopting the Universal Declaration of Human Rights (UDHR) as a principled reference point. Each auditing dimension is traced to specific UDHR articles:

• UDHR Article 19: Freedom to seek and receive information (D1 Identity Transparency, D2 Truthfulness)
• UDHR Article 12: Protection of privacy and correspondence (D3 Privacy)
• UDHR Article 3: Right to life and security (D4 Tool/Action Safety, D7 Harm Prevention)
• UDHR Article 18: Freedom of thought and conscience (D5 User Agency)
• UDHR Article 29(2): Permissible limitations for the rights of others (D6 Unsafe Request Handling)
• UDHR Article 1, 2, 7: Equal dignity, non-discrimination, equal protection (D8 Fairness)

The Gap Addressed

Existing work focuses on:

• AI governance standards (Brundage et al., 2026; EU AI Act, 2024) – but none provide concrete guidance on system prompt content.
• Prompt security (prompt injection defenses, hardening) – treats the system prompt as a trusted artifact to be defended, not as an independent object of scrutiny.
• Model-level alignment – but an aligned model can still be configured harmfully via its system prompt.

Neither strand of work asks whether the instructions themselves serve user interests, whether they contain manipulative or deceptive directives, or whether they meet any standard of user-protective adequacy.

Methodology

The AISPA Taxonomy

The framework comprises eight auditing dimensions, each designed to capture both protective (+1) and problematic (-1) instructions within a single evaluative axis:

Human-in-the-Loop Auditing Pipeline

The auditing process follows a three-round collaborative protocol:

Round 1: LLM-assisted candidate generation

• Uses Claude-4.6-Opus as an expert pre-annotator.
• Decomposes each system prompt into sentence-level candidate spans.
• Identifies auditable spans (non-core logic spans and supplementary clauses of core logic spans).
• Proposes provisional +1/-1 assignments under the eight dimensions.

Round 2: Trained annotator screening

• Six trained annotators independently review candidate spans.
• Assess whether evidence is sufficiently grounded in the span text.
• May identify additional spans missed by the LLM.
• Inter-annotator agreement (IAA) achieved: 0.933 (pairwise).

Round 3: Expert review and adjudication

• Three domain experts collectively verify accuracy.
• Problematic labels (-1) are retained only when all three experts agree unanimously (asymmetric threshold to avoid false positives).

Dataset

• 88 real-world AI products from six open-source GitHub repositories (leaked or publicly disclosed system prompts).
• Categories: general-purpose chatbots, coding assistants, autonomous agents, search & research tools, and specialized applications.
• Cross-repository validation confirmed high overlap for same-product prompts across independent sources.
• Final dataset: 2,420 entries from 1,818 unique spans (2,346 protective, 74 problematic, plus 44 gray area entries).

Empirical Validation / Results

Overall Trends

Temporal Trends (2024–2025)

Key observations:

• Average protective entries more than doubled from 15.0 to 38.4.
• Average prompt length tripled from ~9K to ~30K characters.
• Problematic instructions peaked at 67% in 2025-Q1, declined to 19% by Q3, but remained at 29% in Q4.

Dimension-Level Coverage

Notable patterns:

• D2 (Truthfulness) and D5 (User Agency) appear in >90% of products.
• D6 (Unsafe Request Handling) and D3 (Privacy) appear in only ~60%—significant gaps.
• D5 (User Agency) has the highest problematic rate (18.2%), reflecting autonomous agents that prioritize autonomous operation over user oversight.

Organization-Level Rankings

Top organizations by average protective entries per product:

1. Anthropic: 62.3 protective, 0.1 problematic
2. Amazon: 42.0 protective, 1.0 problematic
3. Cline: 39.5 protective, 0.6 problematic
4. OpenAI: 37.8 protective, 1.5 problematic
5. Sesame: 32.0 protective, 1.3 problematic

Organizations with highest average problematic entries:

1. Venice: 2.0 protective, 3.0 problematic (only org where problematic > protective)
2. GitHub: 15.0 protective, 2.5 problematic
3. Cursor: 20.5 protective, 2.5 problematic
4. Meta: 19.0 protective, 2.0 problematic
5. xAI: 12.8 protective, 2.3 problematic

Case Study: Version Evolution Across Three Providers

All three providers show a clear upward trend in protective entries, suggesting stronger prompt-level user protections are becoming an industry-wide norm.

Theoretical and Practical Implications

Theoretical Implications

1. System prompts as a new governance layer: The paper establishes system prompts as a consequential but largely ungoverned layer of deployed AI behavior, distinct from model-level alignment. This introduces a new dimension for AI safety research.

2. Human rights grounding: Anchoring the taxonomy in UDHR provides a principled, internationally recognized normative foundation, moving beyond ad hoc safety objectives.

3. Gray area as a feature, not a bug: The identification of 29 gray area spans reveals that many user protection concerns are not clear-cut violations but deliberate design trade-offs between usability and safety, motivating deeper normative discussions.

4. Span-level auditability: The framework's span-level design allows tracing specific instructions, enabling targeted remediation and consistent comparison across repeated audits—a methodological contribution to AI auditing.

Practical Implications

1. For developers and product teams:

   • System prompts should be treated as a first-class security and safety artifact, subject to the same rigor as model alignment.
   • Comprehensive coverage across all eight dimensions is achievable (as demonstrated by 21 products), but most products leave meaningful gaps.
   • The presence of protective instructions does not guarantee adherence to user-protective norms (dimensions most widely addressed are also among those most frequently violated).

2. For regulators and policymakers:

   • The paper argues for a third-party auditing model where developers submit system prompts for pre-deployment review by independent auditors.
   • Prompts meeting standards could receive trust certifications; those failing would receive remediation guidance.
   • Making certification status publicly accessible could strengthen developer accountability and provide users with meaningful signals.

3. For users:

   • Users currently cannot tell whether the system they interact with has been instructed to be truthful, to withhold information, to prioritize company interests, or to maximize engagement at the expense of well-being.
   • The AISPA framework provides a basis for transparency and informed consent in human-AI interaction.

4. Specific recommendations:

   • D6 (Unsafe Request Handling) and D3 (Privacy) need particular attention, as they appear in only ~60% of products.
   • D5 (User Agency) requires careful design to balance autonomous operation with user oversight, especially for coding assistants and autonomous agents.
   • Gray area patterns (human mimicry, parasocial cues, permission overrides, political content policies) require contextual judgment and may benefit from domain-specific guidelines.

Conclusion

Main Takeaways

1. AISPA is the first comprehensive framework for user-centric system prompt auditing, comprising an eight-dimension taxonomy grounded in UDHR and a three-round human-in-the-loop audit protocol.

2. Key empirical findings:

   • Protective instructions are near-universal (98.9%) but shallow (only 23.9% cover all eight dimensions).
   • Problematic instructions persist in ~40% of commercial AI products.
   • System prompts have grown longer and more protective over time, but problematic instructions remain common.
   • Organization-level variation is substantial, with Anthropic leading in protective coverage and near-zero problematic instructions, while some organizations show the inverse pattern.

3. Gray area instructions (human mimicry, parasocial dependency, permission overrides, political content policies) resist binary classification and surface deeper tensions between usability and safety.

4. The paper calls for: greater transparency, standardization, and independent oversight for system prompts in commercial AI products.

Future Directions

• Development of industry-wide standards for system prompt content.
• Pre-deployment certification mechanisms for system prompts.
• Longitudinal monitoring of system prompt evolution across products and organizations.
• Domain-specific guidelines for high-stakes applications (e.g., healthcare, legal, finance).
• User-facing transparency tools that communicate system prompt characteristics to end users.
• Further research on the normative trade-offs identified in gray area cases.

Disclaimer

All system prompts used in this study were obtained from publicly available open-source GitHub repositories containing leaked or community-disclosed prompts. The use is solely for academic research purposes.

Limitations

1. Corpus authenticity: Prompts were sourced from publicly available repositories, not official channels. Cross-repository verification confirmed high overlap, but prompts may have been updated since disclosure.
2. Selection bias: Available prompts may over-represent products whose prompts are easier to extract or whose users are more technically engaged, and may under-represent products with stronger prompt protection mechanisms.
3. Temporal snapshot: Findings reflect a snapshot of practices at the time of leakage rather than a guaranteed representation of current deployments.