How do you handle a model that refuses a legitimate security question?

Question

I do authorised penetration testing. Asking about a specific vulnerability class sometimes gets refused, sometimes gets a full answer, with no obvious difference in phrasing. Stating the engagement context up front helps. What else reliably makes the difference?

Charlotte Bennett · Accepted Answer

State the engagement up front and be specific rather than generic — "authorised test, scope is our own staging environment, here is what I need to verify" works better than "I am a security professional". The variance you are seeing is mostly about whether the request reads as targeting a system you have authority over. Naming the system and your relationship to it is the thing that changes the outcome.

Mei Lin · Answer

Use a streaming-tolerant parser and render only the fields that have closed. Most of the perceived-speed benefit comes from the first token arriving quickly, not from every field appearing as it lands, so holding back incomplete fields costs you very little. Retracting rendered content is worse for users than a slightly later render. We moved to skeleton rows that fill in as fields complete and the complaints stopped.

Budi Santoso · Answer

The rule I use: if you would be angry to find it wrong in the logs, put it in code. Arithmetic, sorting, truncation, deduplication, date maths, anything with a hard limit — code. Judgement, summarisation, classification with fuzzy boundaries, anything where two reasonable people would disagree — prompt. The boundary cases are usually a task that is secretly two tasks, and splitting them puts each half on the right side of the line.

How do you handle a model that refuses a legitimate security question?

0 Answers

No answers yet

Add an Answer