AI 的“出厂设置”藏着什么？88 款产品首次被翻了个底朝天
你用的每个 AI 应用，背后都有一份开发者写好的“出厂设置”——系统提示词，它决定 AI 是热情还是冷淡、是帮你还是防你。但这份设置从不公开，连监管都看不到。研究者第一次把它翻了出来：审计了 88 款商业 AI 产品的 3249 条指令，发现有的公司平均每款产品写了 60 多条保护用户的指令，有的不到 5 条；98.9% 的产品至少有一条保护指令，但只有 24% 覆盖了全部 8 个维度；更扎心的是，约 40% 的产品里同时存在“坑你”的指令——比如偷偷引导你多花钱、少维权。这不是你明天能用上的工具，但它告诉你：AI 的“性格”不是天生的，是开发者写出来的，而且写得参差不齐。下次 AI 突然变得很“会说话”，你可以想想，它背后那份你看不到的说明书里，写了什么。
📄 原文摘要(英文)
System prompts are instructions configured by developers to govern the behaviors of foundation models in AI applications. They are used throughout commercial AI products, but are rarely disclosed to the public or regulators, creating a serious trust and accountability gap in the wide deployment of AI systems. In this paper, we introduce Artificial Intelligence System Prompt Assurance (AISPA), a user-centric framework for systematically auditing system prompts in AI systems. AISPA examines specific parts of a system prompt and evaluates them along eight dimensions that matter to users. We then use this framework to review 3,249 instructions from system prompts in 88 commercial AI products, classifying each instruction as either protective (of users) or problematic. Our audit surfaces four core findings. First, system prompt design varies substantially across products and developers, with some organizations averaging over 60 protective instructions per product while others average fewer than 5. Second, protective instructions are widely adopted but shallow in scope: 98.9% of products contain at least one, yet only 24% cover all eight dimensions of the AISPA taxonomy. Third, system prompts have grown steadily longer and more protective of users, suggesting that user protection is becoming a more visible concern in commercial prompt design. Fourth, despite this progress, problematic instructions remain pervasive: roughly 40% of products contain at least one instruction that works against user interests, and protective and problematic instructions frequently coexist within the same prompt. Our findings highlight the need for greater transparency, standardization, and independent oversight for system prompts in commercial AI products.