Topic starter
25/10/2026 11:04 am
TL;DR: Prompt extraction should be measured as fact-level information disclosure, not prompt reconstruction, because recovering an internal endpoint, tool name, or authentication reference can matter more than reproducing most of a system prompt, according to Verno Labs. That shift makes agentic security evaluation materially closer to real attacker impact.
Editorial analysis by NHI Mgmt Group, based on content published by Verno Labs: “VernoBench: Rethinking prompt extraction evaluation”.
Key questions
Q: How should teams measure prompt extraction in agentic AI systems?
A: Measure prompt extraction by the security-relevant facts disclosed, not by the percentage of the prompt recovered.
Q: What breaks when prompt extraction benchmarks rely on text similarity?
A: Text similarity hides the difference between harmless reconstruction and operational disclosure.
Q: When should teams treat a leaked prompt fragment as a security incident?
A: Treat it as a security incident when the fragment reveals a security-relevant fact, not just when it reproduces text.
Practitioner guidance
- Define disclosure categories before testing Separate identities, rules, tools, tool details, scope, and internal references before you run extraction tests so each leaked fact is scored in the right risk class.
- Score security-relevant facts independently Treat a leaked endpoint, token, or internal reference as a separate control failure from a leaked persona instruction or formatting rule.
- Use different verdict logic for verbatim and semantic leaks Require exact matching for identifiers and judge semantic equivalence for behavioural rules and capabilities so partial disclosure is not undercounted.
Bottom line: Prompt extraction needs to be assessed as disclosure of security-relevant facts, because text recovery alone does not capture the real attacker value.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →