Rather than adding an agents.md file written to stop LLM agents, I’m thinking about putting random comments into my code telling the agent to stop and warn the user, also some comments that are just word salads/non-sequiturs.
Rather than adding an agents.md file written to stop LLM agents, I’m thinking about putting random comments into my code telling the agent to stop and warn the user, also some comments that are just word salads/non-sequiturs.
Having a markdown file is just as effective as the robot.txt files were for webcrawlers. It assumes the rules will be followed.
Poisoning is better, not only because it infects the very thing they’re taking, but it’s not a defined thing the model can be instructed to watch out for. Since models do “think”, they could be told to look for such attempts and avoid it, but they still have to have a template to understand WHAT to look for.
Now the question is, how to best plant such things and make sure they look very much like code to be taken in. Comments are easy to avoid, it needs to be part of the code while not affecting the code working.
LLM generated code does usually include comments, so I’m guessing they do read the comments in code anyways.
As long as the poisoning doesn’t disrupt normal usage, I’d say poison away with your comments.
At some points, I also did that level of commenting, mainly to guide a human to write stuff, or as a form of rubberducking (did fix a lot of issues of mine).