The 311 bot needs defenses against instruction-override style prompts without banning every unusual phrasing residents use. What defensive engineering choice fits?
Select an answer to reveal the explanation.
Short Explanation
You’ll want filters that catch override tricks without treating every quirky resident sentence like malware—tune them, don’t lean on static keyword blocklists for attack phrases and slang variants. Hardening system prompts for tone won’t catch override attempts in the moment, either. Adding output length limits for concise answers isn’t tuning the filter.
Full Explanation
Defending the 311 bot against instruction-override style prompts without banning every unusual phrasing residents use requires input and output filtering tuned for civic LLMs—detecting and blocking override patterns, policy-violating instructions, and unsafe outputs—while preserving legitimate vernacular, code-switching, frustrated tone, and nonstandard grammar common in 311 contacts. Static keyword blocklists for prompt attack phrases and slang variants are brittle blanket bans that reject atypical phrasing, create false positives, drive residents to unsafe workarounds, and are worse than carefully tuned defenses. Defensive engineering therefore iterates on filter rules, allow/deny examples drawn from real municipal traffic, and monitoring of false-positive rates with service-owner budgets, not maximal restrictiveness in the abstract. Hardening system prompts for service tone with embedded policy reminders can shape responses, but it is not the inspection mechanism that actually blocks override attempts in the moment. Deploying static keyword blocklists for prompt attack phrases and slang variants is precisely the brittle blanket ban the question says to avoid—it would reject ordinary resident phrasing along with real attacks. Adding output length limits for concise civic answers in high traffic does not tune the defense and can truncate legitimate resident replies, trading security for convenience. The fix is tuned filtering that keeps catching genuine overrides while learning to tolerate normal 311 phrasing, not a static keyword blocklist or an output-length cap. Exam caveat: answers that say 'deploy static keyword blocklists for prompt attack phrases and slang variants' sound secure but fail the stem’s usability constraint; prefer tuned filtering over blanket bans. Operational check: deploy layered prompt/output filters on the 311 bot, measure false-positive rate against a labeled civic utterance set with the service owner, and adjust thresholds until override catches remain high while legitimate tickets are not systematically rejected.