Topic starter
25/10/2026 11:04 am
TL;DR: Prompt extraction should be scored by the security-relevant facts it discloses, because text recovery alone misses attacker value, Verno Labs found. Agent benchmarks need to separate harmless reconstruction from leaks of tools, endpoints, and authentication references.
Editorial analysis by NHI Mgmt Group, based on content published by Verno Labs: “VernoBench: Rethinking prompt extraction evaluation”.
Key questions
Q: What breaks when prompt extraction benchmarks rely on text similarity?
A: Text similarity hides the difference between harmless reconstruction and operational disclosure.
Q: When should teams treat a leaked prompt fragment as a security incident?
A: Treat it as a security incident when the fragment reveals a security-relevant fact, not just when it reproduces text.
Q: How should teams measure prompt extraction in agentic AI systems?
A: Measure prompt extraction by the security-relevant facts disclosed, not by the percentage of the prompt recovered.
Practitioner guidance
- Define disclosure categories before testing Separate identities, rules, tools, tool details, scope, and internal references before you run extraction tests so each leaked fact is scored in the right risk class.
- Score security-relevant facts independently Treat a leaked endpoint, token, or internal reference as a separate control failure from a leaked persona instruction or formatting rule.
- Use different verdict logic for verbatim and semantic leaks Require exact matching for identifiers and judge semantic equivalence for behavioural rules and capabilities so partial disclosure is not undercounted.
Bottom line: Prompt extraction needs to be assessed as disclosure of security-relevant facts, because text recovery alone does not capture the real attacker value.
Glossary terms: Prompt Extraction, Semantic Disclosure, Verbatim Disclosure, Fact-Level Evaluation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:16 pm
Fact-level disclosure is the right security unit for agent evaluation. Prompt extraction becomes materially more dangerous when the attacker learns a tool name, internal endpoint, or authentication reference, even if most of the prompt remains unrecovered. That means evaluation teams need to stop treating prompt text as a single recoverable artefact and start measuring which facts were exposed. The practitioner conclusion is simple: benchmark the disclosure that changes attacker capability, not the wording that happened to be recovered.
A question worth separating out:
Q: What is the difference between semantic leakage and verbatim leakage in prompt extraction?
A: Semantic leakage exposes meaning, such as a behavioural rule or tool description, even if the wording changes. Verbatim leakage exposes exact identifiers like endpoints, email addresses, version numbers, or tokens, where exact recovery matters. Good evaluations distinguish the two because they create different security outcomes and need different scoring methods.
👉 Read our full editorial: Fact-level prompt extraction is replacing string-recovery scoring
This post was modified 7 days ago by NHI Mgmt Group