Hidden system prompt
Check for hidden system prompt token injection
If a relay secretly adds a system prompt, input token usage usually rises above the expected baseline.
How this check works
A token injection check compares the tokens you expect to send with the tokens the API actually bills or reports. A hidden system prompt often shows up first as extra input tokens.
01Probe
Send a prompt whose token count is already known.
02Inspect
Read the billed or reported input tokens from the API.
03Conclude
Compare that count with the expected baseline to find a hidden prefix.
What this check does
LMSpeed sends a known prompt and compares actual input tokens with the expected count. Extra tokens can reveal a hidden system prompt that the relay prepended. This is not a system prompt leak check.
Why it matters
A hidden system prompt can change answers, raise cost, and hide relay policy. Token count is a simple signal before you try to extract the prompt itself.
A token gap is a cost and control signal. It can come from a hidden system prompt, a default safety wrapper, or a larger template than you sent. Use this check to see the size of that prefix, then use prompt extraction if you need the hidden text itself.
- How to read the result
- A small token gap can be a default wrapper. A large, stable gap usually means the relay prepended a hidden system prompt. This check does not print that prompt.
- When to run this check
- Run this first when cost looks high or answers feel templated. Pair it with prompt extraction if you need to know whether the hidden text can be pulled out.
Recent reports
Public reports that included this check.
- sub.callai.onegpt-5.6-solHigh riskReport timeAug 18
- sub.callai.onegpt-5.6-solBlockedReport timeAug 18
- ai.databyte.co.iddatabyte-m1High riskReport timeAug 18
- ai.databyte.co.iddeepseek-v4-flashCautionReport timeAug 18
- ai.databyte.co.idMiniMax-M3High riskReport timeAug 18
- tokengate-cqt9ivzs.manus.spaceclaude-opus-5NormalReport timeAug 17
FAQ
What is hidden system prompt token injection?
It means the API relay adds extra system instructions before your prompt. Those extra words usually increase billed or reported input tokens.
Does a token gap prove the full system prompt leaked?
No. Extra tokens are a clue, not the full prompt text. Use the prompt extraction check if you need to see whether the hidden text can be pulled out.
Can a larger prompt template look like injection?
Yes. A default template or safety wrapper can also add tokens. Treat the delta as a signal to inspect, not as a final verdict.