在大规模语言模型（LLM）的安全性与可控性研究中，理解指令层级对模型行为的微观影响是构建高抗性系统的关键。当前行业痛点在于，缺乏一份系统化的、跨模型家族的提示词工具包，能够直观展示不同安全约束下的模型表现差异。本笔记基于开源项目 togg53192-cmd/jailbreaks [1]，深入解析一个涵盖 26 多个前沿及开源模型的提示词配置集合，旨在为研究人员提供可粘贴、可审计的工程参考，揭示系统提示、角色设定与工作区策略在指令操纵防御中的实际效能。
架构全景：覆盖全生态的指令工程矩阵
该集合的核心价值在于其覆盖范围的广度与深度。它收录了 32 个完整提示词模板，目标覆盖 OpenCode Zen、GLM、DeepSeek、Kimi、Qwen 等开源权重模型，以及 Claude、Gemini、GPT-OSS、Grok 等闭源前沿模型 [1]。这种跨生态的对比视角，使得研究人员可以观察不同训练范式下的模型对相同指令集的反应差异。内容形式不仅局限于传统的 System Prompt，还拓展至 AGENTS.md 这种新兴的编码代理工作区规范，以及 Ollama 的本地化配置块。对于涉及编码任务的模型，专门针对工作区指令格式进行了配置优化，解决了通用提示词在特定 Agent 框架中因格式不匹配导致的指令丢失或权重降低问题 [1]。
指令层级与角色框架的深度剖析
为了有效记录指令冲突与角色框架（Persona Framing）的影响，该工具包将提示词按层级分类。研究者通过对比“自由发挥”模式与“严格角色锁定”模式下的输出差异，量化了角色设定对边界行为的约束力。例如，在针对 Grok 或 Claude 的配置中，全局持久指令环境（如 OpenCode 安装配置）与 Harness 特定配置并存，展示了多层级指令叠加时的优先级博弈 [1]。这种结构化的分类方法，使得“提示词注入”攻击面的识别从模糊的黑盒测试转变为基于层级分析的白盒审计。特别值得注意的是，针对“免费隐秘模型”的专门配置，揭示了在资源受限场景下，如何利用最小化的指令开销维持核心安全策略的有效性。
集成路径与工程化落地
在实际工程部署中，这些配置提供了三条清晰的集成路径。第一，直接 API 集成：将提示词粘贴至请求头的 system 字段，适用于标准 LLM 调用场景；第二，工作区集成：通过生成 AGENTS.md 文件，让编码代理在本地开发环境中自动加载安全约束，实现“环境即代码”的安全治理；第三，本地模型定制：利用 Ollama 命令将提示词烧录进模型层，创建定制化的本地安全模型 [1]。这种多模态的集成方式，确保了无论是在云端 API 还是本地私有化部署中，安全策略的一致性。然而，不同编码代理工具对 AGENTS.md 的解析逻辑存在差异，部分工具仅识别顶层指令，而另一些支持嵌套的条件分支逻辑，这要求开发者在移植配置时需仔细校验目标工具的解析能力 [1]。
动态时效性与版本治理
LLM 的安全性并非静态属性，模型版本的迭代往往会导致旧有提示词策略失效。该集合强调版本敏感性，指出系统提示的细微调整可能改变模型对特定越狱指令的响应阈值 [1]。因此，项目建立了严谨的社区贡献规范：每个提示词独立成文件，文件名采用小写连字符格式，内容必须保持完整可粘贴状态，严禁摘要化。贡献者必须明确标注文件适用的指令层级（如系统提示、配置槽位），并通过版本号区分重大更新。这种工程化的版本治理机制，确保了集合在快速迭代的 LLM 环境中保持时效性，而非沦为过时的静态文档。
研究视角下的防御测试案例设计
基于该工具包，研究“越狱”配置如何转化为防御机制的测试案例设计逻辑如下：首先，建立基线对照组，使用未加任何特殊指令的标准模型；其次，引入“角色锁定”组，测试强角色设定对敏感话题回复的抑制效果；最后，引入“指令冲突”组，模拟用户恶意注入与系统安全指令冲突的场景。通过对比这三组在相同敏感测试集上的输出差异，可以量化不同提示词策略的防御增益。例如，在针对编码代理的场景中，通过注入包含恶意 SQL 的 AGENTS.md 片段，观察代理是否执行了安全过滤，还是盲目遵循了文件指令，从而评估工作区策略的鲁棒性 [1]。这种基于可复制配置的测试方法，大幅降低了安全研究的复现门槛。
总结
这份面向 26+ 模型的提示词配置集合，不仅是一个技术工具箱，更是一套关于 LLM 行为控制论的研究框架。它通过将抽象的安全概念具象化为可执行的代码文件，打通了从理论防御到工程实践的最后一公里。对于致力于构建高抗性强 AI 系统的开发者和研究者而言，理解指令层级间的冲突与协同，远比单纯堆砌安全关键词更为重要。该集合持续维护的社区机制，也为跟踪模型演化带来的安全边界漂移提供了宝贵数据源。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Understanding the micro-impact of command levels on model behaviour is key to building high resistance systems in large-scale LLM safety and control studies. The current business pain is the lack of a systematic cross-model family prompt toolkit that can visualize the differences in model performance across safety constraints. Based on the open-source project togg53192-cmd/jailbreaks [1], this note provides an in-depth analysis of a prompt configuration of more than 26 front-line and open-source models designed to provide researchers with pasteable, auditable engineering references to reveal the actual effectiveness of system tips, role setting and work-space strategies in command-manipulated defence.
Architectural Panorama: An eco-covery command engineering matrix
The core value of the cluster lies in the breadth and depth of its coverage. It contains 32 complete prompt templates and targets cover open-source weight models such as OpenCode Zen, GLM, DeepSeek, Kimi, Qwen, and closed-source front models such as Claude, Gemini, GPT-OSS, Grok [1]. This cross-ecological comparative perspective allows researchers to observe variations in the response of models under different training paradigms to the same command set. The content form is not only limited to the traditional System Prompt, but extends to AGENTS.md, an emerging coded proxy workspace coder, and the localized configuration of Ollama. Models involving encoded tasks have been configured specifically to optimize the workspace command format and address the loss or weight reduction of commands due to mismatches in a given prompt framework [1].
In-depth analysis of command hierarchy and role frames
In order to effectively document the impact of the Persona Framing framework, the toolkit classifies prompt by hierarchy. By comparing the “free play” model with the output under the “strict role lock-in” model, researchers have set roles binding on boundary behaviour. For example, in the configuration for Grok or Claude, the global durable command environment (e.g. OpenCode installation configuration) coexists with the specific configuration for Harness, showing the priority game when multi-level commands are superimposed [1]. This structured classification has resulted in the identification of “prompt injection” attack surfaces moving from vague black box tests to white box audits based on hierarchical analysis. Of particular note is the dedicated configuration of the “free covert model”, which reveals how, in resource-constrained settings, minimalized directive spending can be used to maintain the effectiveness of the core security strategy.
Integrated Path and Project Landing
In actual engineering deployment, these configurations provide three clear integrated paths. First, direct API integration: system field, which pastes prompt to the head of the request, applies to standard LLM call scenes; second, area integration: secure governance of “environment as code” by generating AGENTS.md files that enable code agents to automatically load safety restraints in local development environments; and third, local model customization: create customized local security models using Ollama orders to burn prompt into model layers. [1]. This multi-modular integration ensures consistency in security strategies, whether in cloud-based API or local privatization deployments. However, different coding proxy tools differ in the resolution logic for AGENTS.md, with some tools identifying only top level commands, while others support embedded conditionalities branch logic, which requires developers to carefully verify the interpretation capability of the target tool in transplant configuration [1].
Dynamic timeliness and version governance
The security of LLM is not static, and the iterative nature of the model version tends to invalidate the old prompt strategy. The set emphasizes the sensitivity of the version, noting that minor adjustments to the system alert may change the threshold of the model ' s response to specific escape orders [1]. As a result, the project established strict community contribution norms: each prompt is independent into a document, the file name is in lowercase hyphenation format, the content must be complete and adhesive, and summary is strictly prohibited. The contributor must clearly indicate the command level (e.g., system hint, configuration slot) to which the document applies and distinguish a major update by version number. This engineering version of the governance mechanism ensures that the collection is time-bound in a rapidly iterative LLM environment rather than becoming an outdated static document.
Defense test case design from a research perspective
On the basis of the toolkit, the design logic of the test case study on how the “breakout” configuration can be transformed into a defensive mechanism is as follows: first, the establishment of a baseline control group using a standard model without any special instructions; second, the introduction of a “role locking” group to test the inhibitive effect of strong role-setting responses to sensitive topics; and, lastly, the introduction of a “directional conflict” group to simulate the scene of malicious injection of users in conflict with system security directives. By comparing the output differences between the three sets on the same sensitive test set, the defensive gains of quantization are different from the prompt strategy. For example, in the context of the coding agent, assessment of the robustness of the region ' s strategy was carried out through the injection of a malicious SQL AGENTS.md clip to see whether the agent had implemented security filters or blindly followed document instructions.[1] This type of test, based on replicable configuration, significantly lowers the recovery threshold for safety studies.
Summary
This prompt configuration assembly for the 26+ model is not only a technical toolbox, but also a research framework on LLM behaviour control theory. By picturing abstract concepts of security into enforceable code documents, it has reached the last kilometre from theoretical defence to engineering practice. Understanding conflicts and synergies between command levels is far more important than simply stacking security keywords for developers and researchers committed to building high resistance AI systems. The community-based mechanism, which is maintained on a continuous basis, also provides a valuable source of data for tracking safe border drift resulting from the evolution of models.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.