Practical prompting, backed by research

Ask a model to "develop several approaches and compare them before choosing" — and it dutifully inflates reasoning tokens by 2.4–7.4x. The final code doesn't change by a single line. The bounded efficiency method lets you cut these hidden costs without losing quality — just by removing trigger phrases and adding clear task boundaries. The "scope + done criterion + stop condition" template doesn't increase tokens on any of the six tested models, and on GLM-5.2 it cuts spend in half with the same result.

Discovery: when an LLM summarizes something, it doesn't lose the topic of a blocker. It loses its force. 'Legal hasn't approved this yet' after compression turns into 'might want to check with legal' — same topic, but the stop signal is gone. The method lets you preserve a blocking condition as a hard barrier when passing it between steps of an agentic chain, instead of letting it soften into a polite reminder. The trick is to extract the condition into 4 mandatory fields (status, release condition, owner, fallback option) instead of hoping the model 'will just get' how important it is.

Instruction files for AI agents (CLAUDE.md, AGENTS.md) grow by 226% over their lifecycle — and almost never shrink on their own. Adding a hidden comment to each instruction lets you safely clean up these files without fear that a needed bug fix will come back. The trick: the comment is only seen by the human editing the file, not by the model executing it — so you can write it freely without worrying about extra noise for the agent. In experiments, this eliminated 99.3% of redundant instructions and boosted rule-following accuracy by +23%.

AI writes code that works, but it doesn't think about security on its own — passwords in plain text, secret keys hardcoded right into files, a JWT token signed with a hardcoded password, and anyone can forge someone else's session. in this 6-app, single-run study the security-aware versions had no critical/high findings, with no edits — just by adding a ready-made requirements block to the end of your prompt. The trick is that the model follows specific instructions extremely well — it just doesn't consider security part of the task unless you name it explicitly. Simply writing "password hashes," "secrets from environment variables," "parameterized queries" — and two critical and eleven serious vulnerabilities disappeared from the output.

Between 56% and 85% of the facts found are lost when a task is handed off between AI agents, and that's not a bug but a systematic pattern. A structured handoff protocol lets you preserve risks and exculpatory details when a task is split across several chats or stages. The catch is that the model writing the summary decides on its own what matters, and decides wrong. The method replaces free-form retelling with a mandatory checklist of categories: risk, justification, uncertainty. The model no longer decides what to keep, it just lists, and losses drop from 85% to nearly zero.

Finding: the LLM judge doesn't care whether the past score was 1.0 or 3.9. All that matters is that it was mentioned at all. That means you can't trust LLM ratings on repeat reviews: 7 out of 8 models systematically lower the new score if they see the old rating's history, even when the text got better. The mere mention of a past score switches the model into "be stricter" mode: GPT-4.1's probability of picking the top score drops from 93% to 0% as soon as a "previous score" field appears in the prompt.

Key finding: when one prompt asks an LLM to verify a long checklist (45–174 criteria in the study), the model admits it checked only a fraction: Sonnet 4.6 reported checking 16% of 174 criteria and 27% of 45. Overloaded, it judges by impression instead of evidence: on honest submissions it rejected 74–88% of items experts had marked as met, and a persuasive cover note can swing it the other way. Splitting the list into small batches, each sent with the full document and a required quote, keeps every verdict tied to the text.

Discovery: an LLM catches a planted extra item in a list 6-7 times more often than its own omission — it's blind to the gaps it creates itself. The "rule instead of a list" method lets you get a complete checklist of correct answers or test cases with no silent losses. Instead of asking it to list everything — ask it to formulate a rule for checking one candidate at a time: accuracy jumps from 0.48 to 0.99, because compiling a list and evaluating a single option are different tasks for the model, even though the underlying knowledge is the same.

You ask the LLM to 'write tests for this code' — and you get tests that would pass even on broken code. The model copies the code's logic instead of checking what it's supposed to do. Spec-Driven Test Generation lets you find missing edge cases through an explicit behavior contract — before you write a single test. The model spells out preconditions and postconditions, marks what's already covered (checkmark) and what isn't (X), and writes tests only for the gaps — it can't write a test 'just to have one,' only for a specific uncovered condition.

Two AI agents are supposed to argue with each other, but in practice they just agree — even when one of them is right. In one test, the critic raised a real problem in the code, the reviewer brushed it off with a confident empty phrase without a single reference to the code — and the critic backed down. The Adversarial Review method forces the critic to choose one of three options: agree, cite evidence of disagreement, or raise a question without a citation — and then the reviewer must either confirm the concern with its own citation or drop it. This gives you a real, evidence-based check of code, text, or a contract instead of a polite "looks fine."

One phrase, "consider diversity," and the model starts inventing a patient's race that wasn't in the question. This breakdown of Demographic Injection shows when an equity instruction makes AI mix in nonexistent details, and how to block it with one line in your prompt. Without the phrase, the model fabricates demographics in 0.7% of answers; with the DEI phrase, in 33%, a 47-fold jump. The model confuses general statistics about a category of people with a fact about the specific person in the question, and in 99.8% of cases where the fabrication changes the answer, the answer becomes wrong. The effect held across all 47 models tested, from GPT-5 to small open ones.

Three out of sixteen code samples that Claude wrote without a single mention of security turned out to be real vulnerabilities — an exposed debugger with remote code execution and endpoints leaking every user's personal data with no permission checks. One phrase in the prompt about the SOC 2 standard (or GDPR, HIPAA) gets you code that closes these holes on its own — no follow-up requests or fixes needed. The model solves the task literally — if you didn't say the data was sensitive, it won't treat encryption and logging as part of the job, even though it perfectly knows how to do them. Just naming the standard — compliance jumps from 47-88% to 86-100%.

An LLM playing therapist asks questions three times more often than real psychologists, and can't stop even when the person has already told it everything. Move Framing lets you make the model run a varied conversation: explain mechanisms, set goals and propose a plan, not just pin down details. The trick: don't ask the model to reply freely; give it an explicit menu of 10 action types, describe when each fits, and have it choose before every reply. The result: the deviation from human behavior drops by half, and agreement with real therapists' decisions rises by 7-9 percentage points.

The paradox: a system of 8 translator-and-critic agents lost to a single prompt with 6 examples. The Direct Judge method finds meaning loss in translated technical requirements — when "50 milliseconds" quietly turns into "50 microseconds" while the grammar stays flawless. The model receives both texts and 6 examples of different drift types in a single prompt — instead of a chain of translator, structure extraction, cross-check, and critique. Result: it beat all 6 architectures, including a full multi-agent system.

The tag in a prompt literally turns into the grammatical subject — the model parses XML as if it were sentence syntax. The "structure for reading, prose for writing" method lets a single prompt precisely locate every point in a long brief while still writing in a natural voice instead of bureaucratic "The Client requires..." phrasing. The trick is to split markup by role: whatever the model searches for, wrap in tags; whatever it writes from, leave as prose. Mix the roles up, and the share of on-point answers drops by nearly a third.

The finding: an LLM refuses to admit its mistake if it made the decision itself, even when the irrelevance is spelled out in the text right in front of it. Context isolation lets you make the model judge its own conclusion as an outside observer, without authorship bias. The trick is that the "I decided this" trace is removed from the context: the model sees only the facts, as if it were reading someone else's work. The result: the model instantly notices the irrelevance it was ignoring a second ago.

Accuracy swings from 65% to 96% — with one prompt that hands over all the classification rules at once. The Hybrid method fixes this roulette. It splits classification into two steps — and accuracy settles at a steady 95-99% across all tested models. First the model just pulls facts into JSON, without a single conclusion. Then, in a separate step, it applies the rules only to the clean data — with no source text at hand.

Finding: an AI reviewer scores not the facts but how confidently a text talks about itself. Same paper, same résumé experience — but swap "this may be related to X" for "we are the first to show X" and the score creeps up. A strict prompt that demands evidence lets you reduce this skew when AI grades texts. The twist: if the AI is already skeptical, confident delivery lifts the score more than usual — and if the AI is already impressed, cautious wording drops the score more.

Finding: LLMs confuse "didn't find it" with "doesn't exist", without even checking whether they saw the whole document. Coverage Certificate lets you force the model to check data completeness before it says "no." The method breaks one fuzzy conclusion into three clear text fields (scope of the question, scope of the data, comparison), and only then comes the final verdict. If the contract's exhibits didn't make it into the prompt, the model will honestly say "I don't know" instead of a hasty "no."

The model is wrong with the same confidence on real and faked data: the numbers don't matter, only the packaging does. Without context, an AI agent honestly says "this is unpredictable" 9 times out of 10. But show it a table with RSI and MACD, and confident forecasts shoot up almost 6-fold, even if every number on the dashboard was invented from scratch. The method separates in time the moment of judgment from the moment the data is shown — first we ask the model whether the question is knowable, and only then show the "evidence."

6% → 54%: that's how much the chance of repeating a failed call grew once the model saw the exact text of its own failed attempt. Rephrasing the error in your own words lets you fix an LLM's failed attempts without loops of the same mistake over and over. The catch: the model doesn't respond to the meaning of the feedback; it copies what's in front of it. Remove the exact text of the failure, keep only the gist, and the copying effect nearly disappears.

Ask a model in one request to recall a complex fact and immediately output strict JSON, and it mixes up the two tasks and drops half the list. REAP lets you get complete lists of facts and accurate numbers from an LLM without searching the internet, just through the right request structure. The secret: recalling and formatting go into two separate steps, and before answering, the model first checks whether the question even applies. The result: a list of award winners over 100 years comes back almost complete, not half-finished.

The model physically can't say "I'm not sure" — it will output 95% confidence even for complete nonsense, because it always writes in a confident tone. The C3 method lets you check whether the model actually knows a fact or is just guessing based on a pattern — without access to its internal weights. You ask the same question twice: once plainly, and once with a neutral lead-in phrase before it. The trick: if the answer shifts because of harmless noise around the question, the model is guessing, not knowing.

The finding: GPT-5 agrees with itself more strongly than two human researchers agree with each other on the same survey. The four-prompt method lets you turn hundreds of open-ended answers into categories and themes without a predefined coding scheme: the model derives the structure from the text itself, the way a researcher does in qualitative analysis. The trick is to split "come up with categories" and "sort into categories" into two separate requests, so the model doesn't juggle creation and application at once. But the higher the level of generalization (from specific categories to big themes), the more the result diverges from human logic.