LLMs, GenAI, RAG, agents, evaluation · insight-1606
Plant unique canary strings so that a leaked prompt or document announces itself
- Evidence type
- practitioner heuristic
- Difficulty
- easy
- Roles
- ML engineer, Applied AI
- Industries
- saas, cross-industry
Summary: situation, action, reason, boundary
Situation
System prompts, restricted documents and logs could leak through an output, a vendor or a screenshot, and you would have no signal when that happens.
Action
Put a random, unique token in each system prompt and in a sample of restricted documents, one per environment and tenant. Scan model outputs and egress traffic for these tokens, alert on a hit and use the token to find which prompt or document leaked.
Reason
A canary is a deterministic tripwire for verbatim copies that does not depend on model behaviour. OWASP lists system prompt leakage as its own risk category.
Boundary
Multi-tenant assistants and any system with confidential prompts or private corpora.
Symptom or risk
The leak is discovered only when a customer or a journalist shows you the text, long after it spread.
Exceptions
Paraphrased leaks pass unnoticed, so a canary complements access control and never replaces it.
Trade-offs
Tokens cost a few prompt tokens and add noise to retrieval if placed in indexed text.
Pitfalls
One shared canary everywhere, which cannot localise a leak, and reading silence as proof that nothing leaked.
Lessons and concepts
Claims and their sources
The OWASP Top 10 for LLM Applications 2025 lists System Prompt Leakage among its risk categories.