Keeping an AI chatbot from being jailbroken

Pix answers questions about my work. Anyone can type anything into it, so it needs to hold its ground when someone tries to make it do something else.

Layer one: clean what comes in

Invisible characters (zero-width spaces, direction overrides) are stripped from every message. They're the usual way to hide instructions inside an innocent-looking question.

Layer two: refuse before the model sees it

Messages that try to override the rules, switch persona or 'mode', extract the instructions, or paste chat-template markers get a fixed reply and never reach the model. The checks also catch spaced-out letters, base64-encoded tricks, and Tagalog and Cebuano versions.

• 23 out of 23 attack prompts caught.
• 17 out of 17 ordinary visitor questions let through.

Layer three: rules on both ends

The instructions open and close with the same security rules, so a long conversation can't push them out of view. They also say plainly that text claiming to come from the system or from me has no authority.

Layer four: watch what goes out

The instructions contain a random reference code that should never appear in an answer. Replies are watched as they stream, with the last few dozen characters held back, and cut off the moment they contain the code or start reciting the instructions.

“No single check is perfect. Four simple ones, each catching what the others miss, are hard to get past.”