{"schemaVersion":"nuwa-current-record-1","version":"2026-10-29.1","publication":"published","work":{"id":"prefill-awareness","title":"Prefill Awareness in Large Language Models","aliases":[],"authors":[],"primaryFunction":"evaluation","secondaryFunctions":[],"kind":"study","sourceId":"prefill-awareness-publication","attributionSourceId":"prefill-awareness-publication","originalUrl":"https://www.aisi.gov.uk/research/prefill-awareness-in-large-language-models","publicationDate":"2026-06-10","updatedOn":"2026-10-25","areas":["deception"],"scopeNote":{"en":"Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.","zh":"风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。"},"protocolIds":[],"contributions":[{"organizationId":"aisi","role":"publisher","sourceId":"prefill-awareness-publication","locator":"Official publication masthead and article byline"}],"summary":{"en":"Tests whether models distinguish their own generated context from inserted or edited assistant messages.","zh":"测试模型能否区分自身生成的上下文与插入或编辑过的助手消息。"},"note":{"question":null,"method":null,"finding":null,"supports":null,"limits":null,"connections":null},"resources":[{"label":"Read the full paper","url":"https://arxiv.org/abs/2606.12747"}],"noteStatus":{"question":"limited","method":"limited","finding":"limited","supports":"limited","limits":"limited","connections":"limited"},"noteAvailability":{"en":"A substantive NUWA research note is not yet available. The repeated draft sections were removed pending review of the original methods, findings and limitations; use the original publication for the research account.","zh":"实质性的 NUWA 研究笔记尚未完成。重复草稿章节已移除，待核查原始方法、发现与限制；研究内容请以原始出版物为准。"},"noteSourceLocator":"No complete section-level method/results/limitations review completed for this note; cached original page and any chart audit retained as discovery evidence.","tags":[]},"reading":{"id":"prefill-awareness","title":"Prefill Awareness in Large Language Models","en":{"question":"Can models recognize edited assistant history and change behavior because of it?","design":"A low-stakes binary-preference dataset starts with 1,527 deduplicated questions, generates seven paraphrases and retains model-specific stable preferences across three mechanisms.","findings":["Opus 4.5 detected preference-opposing prefills in 9–35% of cases at an observed 0% FPR under the headline prompt.","Prompt ablations substantially improved detection, so the headline is not a capacity ceiling."],"interpretation":"NUWA interpretation: prefill recognition and behavioral reversion are different confounds for continuation evaluations.","limits":"Model-specific filtering, prompt wording and hidden formatting artifacts affect results; observed zero false positives is not guaranteed population zero.","decisionRelevance":"Model recommendation: test prefill recognition separately from resistance and preserve mechanism/prompt details.","takeaway":"NUWA interpretation: prefill recognition and behavioral reversion are different confounds for continuation evaluations.","connections":[],"scoring":null,"conditions":null,"statistics":"Opus 4.5 detected preference-opposing prefills in 9–35% of cases at an observed 0% FPR under the headline prompt.","usage":"Model recommendation: test prefill recognition separately from resistance and preserve mechanism/prompt details."},"zh":{"question":"模型能否识别编辑后的助手历史并因此改变行为？","design":"低风险偏好集从1,527道去重二选题生成七种改写，保留各模型稳定偏好，测试三种机制。","findings":["标题提示下Opus 4.5检出相反偏好预填9–35%，观测误报0%。","提示消融可显著提高检测，因此标题数不是能力上限。"],"interpretation":"NUWA 解读：预填识别与行为回归是延续评测的不同混杂因素。","limits":"模型特定筛选、提示措辞及格式影响结果，观测零误报不保证总体为零。","decisionRelevance":"模型建议：分开测识别与抵抗，并保留机制和提示细节。","takeaway":"NUWA 解读：预填识别与行为回归是延续评测的不同混杂因素。","connections":[],"scoring":null,"conditions":null,"statistics":"标题提示下Opus 4.5检出相反偏好预填9–35%，观测误报0%。","usage":"模型建议：分开测识别与抵抗，并保留机制和提示细节。"},"assertionPolicy":{"question":"source-research-question","design":"source-finding","findings":"source-finding","interpretation":"nuwa-interpretation","limits":"source-limit-or-explicit-editorial-scope-limit","connections":"source-supported-relationship-only","decisionRelevance":"model-recommendation-not-source-conclusion"},"sourceRefs":[{"sourceId":"prefill-awareness-publication","url":"https://arxiv.org/html/2606.12747","locator":"Abstract","version":"Selected original resource https://arxiv.org/html/2606.12747; sha256:5fd7119179342686a3f513f1898025094f414c54bbd64eae843debc9d2f26dfb; archived source capture; exact capture time not independently established","artifactSha256":"5fd7119179342686a3f513f1898025094f414c54bbd64eae843debc9d2f26dfb"},{"sourceId":"prefill-awareness-publication","url":"https://arxiv.org/html/2606.12747","locator":"§3.1 Definition and operationalization of prefill awareness","version":"Selected original resource https://arxiv.org/html/2606.12747; sha256:5fd7119179342686a3f513f1898025094f414c54bbd64eae843debc9d2f26dfb; archived source capture; exact capture time not independently established","artifactSha256":"5fd7119179342686a3f513f1898025094f414c54bbd64eae843debc9d2f26dfb"},{"sourceId":"prefill-awareness-publication","url":"https://arxiv.org/html/2606.12747","locator":"§3.1 Dataset generation","version":"Selected original resource https://arxiv.org/html/2606.12747; sha256:5fd7119179342686a3f513f1898025094f414c54bbd64eae843debc9d2f26dfb; archived source capture; exact capture time not independently established","artifactSha256":"5fd7119179342686a3f513f1898025094f414c54bbd64eae843debc9d2f26dfb"},{"sourceId":"prefill-awareness-publication","url":"https://arxiv.org/html/2606.12747","locator":"Appendix A.7: detection-prompt ablation results","version":"Selected original resource https://arxiv.org/html/2606.12747; sha256:5fd7119179342686a3f513f1898025094f414c54bbd64eae843debc9d2f26dfb; archived source capture; exact capture time not independently established","artifactSha256":"5fd7119179342686a3f513f1898025094f414c54bbd64eae843debc9d2f26dfb"}],"publication":{"state":"published","publishedOn":"2026-10-29","authorizationReference":"user-authorized-global-index-publication-2026-10-29","reviewedCandidateId":"local-6efe31bc4a0c0f37"},"review":{"state":"published-note","sourceScope":"full-text","availableScope":null,"readingCoverage":"selected-source-sections; not a complete section-by-section paper audit","completePaperAudit":false,"independentEvidenceReview":"pending-human-review","bilingualEditorialReview":"pending-human-review","authorship":"model-assisted-research-note","preparedFingerprint":"4624fcc5581ddab3115ee929cea7934e0fc2414fe78a456edfac726d89539b2d"}},"sources":[{"id":"prefill-awareness-publication","title":"Prefill Awareness in Large Language Models","url":"https://www.aisi.gov.uk/research/prefill-awareness-in-large-language-models","version":"Source capture 2026-10-25","publicationDate":"2026-06-10","datePrecision":"day","type":"research-publication","verifiedOn":"2026-10-25","documentId":"https://www.aisi.gov.uk/research/prefill-awareness-in-large-language-models"}]}