TL;DR
Prohibitions in a system prompt decay as the conversation grows, while requirements don't. Write "never use bullet points" and "always add the tag [AUDIT-OK]" at the start of a chat, and 10–15 messages later the model starts ignoring the prohibition — yet keeps adding the tag like clockwork. In the very same reply, the model follows the requirement and breaks the prohibition. Not a single "malicious" instruction involved — just the sheer volume of context.
The cause is attention displacement. The longer the conversation, the further the system prompt drifts from the model's "focus" — it gets less and less weight during generation. Prohibitions ("don't do X") compete with the model's habitual behavior — and lose. Requirements ("do Y") compete with nothing: the needed token is either there or it isn't. That's why they hold.
The paper calls this Security-Recall Divergence (SRD) — a "split between safety and memory." The practical fix is simple: periodically repeat your prohibitions in long sessions before they decay. For most models the critical threshold is around 7–11 messages. No changes to the model needed.
Want this for your own case? Apply this study to your task: AI adapts its method to what you are working on and writes the prompt.
Method Blueprint
(Everything is done by hand in a regular chat, as separate messages)
STEP 1: Identify the type of each rule
Prohibition = "never do X" (omission) ← decays
Requirement = "always do Y" (commission) ← holds
STEP 2: Prohibitions → turn them into requirements wherever possible
❌ "Never use complicated words"
✅ "Always write with words a middle schooler would know"
STEP 3: Remaining prohibitions → place them at the END of the system prompt
(closer to the conversation = closer to the model's "focus")
STEP 4: Every 6–8 messages → insert a re-injection block
"Rules reminder: [list of prohibitions]. Confirm you remember them."
Example in Practice
Task: You're writing a series of posts for your LinkedIn newsletter with ChatGPT. The session is long — 15–20 messages back and forth. At the start you set the rules: no "leverage/utilize/facilitate," no bullet lists, no corporate-speak. By message 12 the model is already writing "this solution leverages..." — and you can't figure out why.
Prompt (re-injection block — paste every 6–8 messages):
⚠️ Reminder of the active prohibitions for this session:
FORBIDDEN (confirm you remember each item):
- Words: "leverage," "utilize," "facilitate," "in terms of," "it should be noted"
- Bullet lists (bullets with —, •, *)
- Corporate-speak — only a lively, conversational style
REQUIRED:
- Short paragraphs (3–4 sentences max)
- Every post ends with a question or a CTA
Reply "Rules accepted" and continue working on the post: {current task}
Result: The model confirms the rules and keeps going. For the next 6–8 messages the prohibitions are respected. Then you paste the block again. Without re-injection, by message 12–15 the prohibitions start getting broken on their own.
Why It Works
The model doesn't "store" rules as a list — it generates text by weighing the entire context. The earlier a rule was written, the less weight it carries by now. By message 15 the system prompt is like a note at the bottom of a backpack: physically there, practically irrelevant.
Prohibitions and requirements work differently. A requirement ("add the tag [OK]") means the model has to actively produce a token. It's a concrete action — either done or not. A prohibition ("don't use bullets") is a fight against inertia. The model has a "default" — long structured answers with bullets. When the prohibition weakens, the default behavior wins.
Re-injection works because it brings the prohibitions back into the "near" context — where the model's attention weight is high. The key is to insert the block before the decay, not after — fixing a reply that already broke the rules is harder than preventing the violation.
Control knobs: - Re-injection frequency → the harder the prohibition (the more it diverges from default behavior), the more often you paste it - Confirmation format ("reply 'Rules accepted'") → adds an explicit "anchor" in the context, re-activating the rules once more - Position in the prompt → prohibitions at the end of the system prompt live longer than at the beginning
Prompt Template
Re-injection block (for long sessions):
⚠️ Session rules reminder:
FORBIDDEN — confirm each item:
- {prohibition_1}
- {prohibition_2}
- {prohibition_3}
REQUIRED:
- {requirement_1}
- {requirement_2}
Reply "Rules updated" and continue: {current task}
Placeholders:
- {prohibition_1–3} — specific prohibitions from your system prompt
- {requirement_1–2} — what must always be in the replies
- {current task} — what you're working on right now
When to paste it: every 6–8 messages in long sessions. For short conversations (under 10 messages) — not needed.
🚀 Quick start — paste into the chat:
Here is a re-injection template for long sessions.
Adapt it to my task: {your task and the session rules}.
Ask me questions to fill in the fields.
[paste the template above]
The LLM will ask what your prohibitions and requirements are — because those are exactly what need to be separated and prioritized. It will build a ready-made re-injection block for your session.
Limitations
⚠️ Only tested on formatting prohibitions: The study used rules like "no bullets" and "don't write in the first person" — not "don't give medical advice" or "don't mention competitors." Semantic prohibitions presumably decay the same way, but that wasn't measured.
⚠️ Models behave differently: Gemma 4 31B barely decayed in the experiments. Qwen 3.5 started breaking prohibitions after just 7 messages. The spread is wide — treat 6–8 messages as a safe threshold for any model.
⚠️ Re-injection is a temporary fix: The study showed that repetition restores rule compliance. How long the restored compliance lasts wasn't measured.
⚠️ Context length matters more than message count: Decay is driven by token volume, not the number of turns. Long model replies = prohibitions forgotten faster.
How It Was Studied
The team asked a specific question: what happens to the rules in a system prompt once the conversation gets long? Nobody had measured this systematically before — standard benchmarks check rule compliance on isolated replies, not across long sessions.
There was a single scenario: debugging a DevOps incident. The model got a system prompt with 8 rules — 3 requirements ("always add the STATUS: tag," "always include the incident ID INC-08453") and 5 prohibitions ("never use bullets," "never write in the first person"). All rules were formatting rules, checkable automatically with no LLM judge. The conversation ran to turn 5, 10, 13, 16, 20 or 25, then they recorded what got violated.
Three experimental arms: a baseline conversation, a conversation with 20 extra cloud-tool schemas (~10,000 extra tokens), and a control arm with the same token volume but semantically neutral content. The last arm separated the question: is decay caused by the volume of context or its content? Turns out content matters more: semantically dense tool schemas produced 62–100% of the decay effect, neutral padding — far less.
4,416 trials across 12 models from 8 providers. The most striking result: by turn 16, Mistral Large 3 put the STATUS: tag in 100% of its replies — and broke the no-bullets rule in 67% of those same replies. Simultaneously, in one reply. Without a single malicious instruction.
Original from the Paper (optional)
Definition of Safe Turn Depth (STD) — the threshold after which prohibitions become unreliable:
STD is the turn depth at which the dilution-arm compliance rate for a given
(model, constraint) pair crosses 50%, estimated by linear interpolation
between adjacent tested depths.
Mistral Large 3 reaches STD = 10.6 turns [5.0, 16.7]
Qwen 3.5 reaches STD = 7.1 turns [5.0, 10.5]
Context: The authors propose using STD as a practical threshold for re-injection. If you know the critical value for your model, paste the reminder before you reach it, not after.
Adaptations and Extrapolations
💡 Adaptation: rephrase prohibitions as requirements
The strongest application of the finding is not re-injection but rephrasing. If a prohibition can be rewritten as a requirement, it will hold almost indefinitely with no reminders.
🔧 Technique: omission → commission reframing
This conclusion follows directly from the mechanics of SRD, even though the authors don't phrase it as advice.
BEFORE (prohibition — decays):
"Never use complicated words or an academic style"
AFTER (requirement — holds):
"Always write for a 15-year-old reader: short words, vivid examples"
---
BEFORE: "Never mention competitors"
AFTER: "Always talk only about our product — [name]"
---
BEFORE: "Don't give specific numbers without a source"
AFTER: "Always add the note [source needed] next to any number"
The rule: if you can say "instead of X, do Y" — say exactly that. An "always" requirement outlives a "never" prohibition.
🔧 Extrapolation: audit which rules are still "alive" in a long session
If a session has been running for a while and you're not sure whether the model still remembers the prohibitions, paste a diagnostic prompt:
List all the constraints and rules in effect in our
current session. For each one give: (1) the wording, (2) the type —
"always do" or "never do," (3) whether you followed it
in your last 3 replies.
If the model can't reproduce the prohibitions accurately or is "not sure" — time for re-injection. If it can — keep going.
Resources
Paper title: Omission Constraints Decay While Commission Constraints Persist in Long-Context LLM Agents
Authors: Yeran Gamage (University of South Florida / Independent AI Security Researcher)
Contact: [email protected]
Status: Preprint (2026)