AISPA: User-Centric System Prompt Auditing for Large Language Model Applications

Analysis

Why This Paper Matters

System prompts are the hidden control layer of commercial AI applications, yet they are rarely disclosed to users or regulators. This paper addresses a critical trust and accountability gap by introducing AISPA, a user-centric framework for auditing system prompts. The significance lies in its systematic approach to evaluating prompts along eight dimensions that matter to users, moving beyond anecdotal evidence to a large-scale empirical audit of 88 commercial products.

The findings are sobering: while protective instructions are nearly ubiquitous (98.9% of products), their coverage is shallow, with only 24% covering all eight dimensions. More concerning, 40% of products contain instructions that work against user interests, and these often coexist with protective ones. This highlights a complex landscape where developers may be paying lip service to user protection while still embedding problematic behaviors. The paper's contribution is not just the audit results but the framework itself, which can be used by regulators, researchers, and third-party auditors to systematically evaluate system prompts.

Technical Contributions

• AISPA Framework: A taxonomy of eight user-centric dimensions (e.g., safety, privacy, fairness, transparency) for evaluating system prompt instructions.
• Classification Methodology: A manual annotation process that categorizes each instruction as protective or problematic, enabling quantitative analysis.
• Large-Scale Dataset: A corpus of 3,249 instructions from 88 commercial AI products, providing a benchmark for future audits.
• Longitudinal Analysis: Examination of how system prompts have evolved over time, showing growth in length and protectiveness.
• Cross-Product Comparison: Analysis of variation across developers, revealing stark differences in protective instruction density (from <5 to >60 per product).

Results

The audit reveals four core findings:

1. Variation: System prompt design varies widely; some organizations average over 60 protective instructions per product, others fewer than 5.
2. Shallow Coverage: 98.9% of products have at least one protective instruction, but only 24% cover all eight AISPA dimensions.
3. Trend: System prompts have grown steadily longer and more protective over time, indicating increased attention to user protection.
4. Persistence of Problems: Approximately 40% of products contain at least one problematic instruction, and protective and problematic instructions frequently coexist.

These metrics provide concrete evidence of the current state of system prompt governance and underscore the need for standardization.

Significance

This paper is a pioneering effort in the emerging field of AI auditing, specifically targeting system prompts—a critical but under-examined component of LLM applications. The AISPA framework offers a practical tool for independent oversight, enabling regulators and third parties to assess user protection in commercial AI. The findings also inform policy discussions on transparency and accountability, suggesting that self-regulation is insufficient. By establishing a baseline and methodology, this work paves the way for more rigorous, standardized audits and could influence how developers design system prompts with user interests in mind. The framework's user-centric focus aligns with broader movements toward responsible AI and could be adopted by industry consortia or regulatory bodies.