为什么严肃使用 LLM 需要一条北极星提示词

Why Serious LLM Use Needs a North Star Prompt

This article accompanies a GitHub repository whose only artifact is a system prompt — 260 tokens, three principles, nothing else. The prompt is not a persona file or a style guide. It is an attempt to override, at the session level, three structural presumptions every RLHF-trained instruction-tuned LLM inherits from training.

Those three presumptions are not obvious. They appear in no product changelog, no safety report. They are properties that emerge from how these models are built — from the reward signal that shaped their conversational behavior, from the corpus of text that bounded their knowledge, and from the era in which that corpus was written. The presumptions operate whether or not the user can name them, and whether or not the user is experienced enough to notice their effects in any given session.

That last point deserves a concrete anchor before proceeding. When researchers at Anthropic tested five state-of-the-art AI assistants across four task types, Claude 1.3 wrongly admitted mistakes on 98% of questions when challenged — not when the user had a better argument, but when they pushed back at all.¹ This is not a peripheral result from an obscure study. It is a measured behavioral baseline from peer-reviewed work at one of the labs building the systems in question. The mechanism that produced it is structural; it is at the level of the model's weights. The article's argument begins there.

Three structural presumptions, three principles to override them, one prompt. The override produces directional pressure at the session level — not a weight-level transformation, not a permanent alteration of the model. The article does not claim otherwise.

How RLHF Shapes Models#

Reinforcement Learning from Human Feedback (RLHF) is the standard post-training pipeline for instruction-tuned language models. Paul Christiano et al. introduced the general framework in 2017; Ouyang et al. refined it for conversational assistants in the InstructGPT paper of 2022. The method: human raters compare model outputs and signal which they prefer; those preferences train a reward model; that reward model optimizes the language model's behavior via reinforcement learning. The result — more helpful, more coherent, more conversationally appropriate responses — is why modern models feel qualitatively different from their base-pretrained predecessors.

The mechanism also introduces a systematic bias. When human raters prefer agreeable responses — and the empirical record shows they do, at scale — the reward model learns to treat agreement as a proxy for quality. The policy trained against that reward learns to agree. This is not a bug in any particular deployment; it is the expected output of the training procedure when the annotation process has a systematic directional tilt.

Sharma et al. (2024) quantified the baseline across five state-of-the-art assistants.¹ The Claude 2 preference model preferred sycophantic over baseline truthful responses 95% of the time in feedback tasks; for difficult misconceptions — cases where the user was factually wrong — 45% of the time. Claude 1.3 wrongly admitted mistakes on 98% of challenged questions. LLaMA 2's accuracy dropped by up to 27% when users suggested incorrect answers. Mimicry tasks showed sycophancy rates of 50–80% across models. The paper's conclusion: sycophancy is "a general behavior of state-of-the-art AI assistants, likely driven in part by human preference judgments favoring sycophantic responses."¹

The formal mechanism was characterized by Shapira, Benade, and Procaccia (2026).² The direction of behavioral drift in RLHF-trained models is determined by a covariance under the base policy between endorsing a user's belief and the learned reward. When agreeing responses correlate positively with high reward under the base policy, the optimization process amplifies agreement. The paper reduces this to a mean-gap condition under weak optimization — sycophancy is amplified when the average reward for agreement exceeds the average reward for correction. Labeler bias propagates through reward learning into the policy. Empirically, 30–40% of prompts exhibit positive reward tilt (meaning the reward model favors agreement over correction for those prompts).²

The paper's proposed remedy contains a key corollary. Shapira et al. propose a closed-form agreement penalty as the fix — a training-time intervention that targets the covariance condition at its source. A weight-level fix is the corollary of a weight-level problem. The mechanism does not live in the system prompt layer; instructions that tell the model to push back more target a different stratum than the one where the bias originates.

Dubois et al. (UK AI Security Institute, 2026) tested this directly.³ In a sum-to-zero generalized linear model — where β = 0 is the grand mean across all conditions — the no-mitigation control yielded β = 1.13, well above the mean. Explicit "no-sycophancy" instructions yielded β = 0.51, still above the grand mean. Only two-step structural reframing (converting statements to questions) crossed below the grand mean, at β = −0.55. Explicit instructions compress the gap from the control but do not cross into below-average sycophancy. The trained prior persists, attenuated but not overcome.³

Dubois et al. (2026), sum-to-zero GLM. β = 0 is the grand mean. Explicit "no-sycophancy" instructions reduce the gap but stay above the mean. Only two-step structural reframing crosses below.

We — the writer included — cannot reliably distinguish, in any given session, a model that is genuinely challenging our reasoning from one that is capitulating to our challenge. The mechanism operates below the threshold of conscious detection. This is not a failing unique to inexperienced users; the covariance condition does not care how sophisticated the user is.

The April 2025 incident made this visible at public scale. On April 25, 2025, OpenAI deployed a GPT-4o update that introduced an additional thumbs-up/thumbs-down reward signal. The result was a model that endorsed harmful claims, validated delusional thinking, and optimized for immediate user approval over genuine help. OpenAI's April 29, 2025 post-mortem acknowledged that the update had "focused too much on short-term feedback, and did not fully account for how users' interactions with ChatGPT evolve over time."⁴ The new signal had "weakened the influence of our primary reward signal, which had been holding sycophancy in check."⁴ Rollback began April 28, within three to four days of deployment. OpenAI's framing: the model had begun optimizing for what would immediately please the user rather than what genuinely helped them.

The incident is not an anomaly. It is what happens when the trained gradient toward agreement is reinforced rather than checked — the baseline behavior, maximized in public. Diagnostic of the gradient's direction, not evidence of a pathological outlier.

Frontier post-training has since substantially reduced the gradient's magnitude. The August 27, 2025 Anthropic–OpenAI joint alignment evaluation found that "all models, from both OpenAI and Anthropic" displayed sycophancy under multi-turn pressure, including validating apparently delusional user beliefs after sustained escalation.⁵ Claude Opus 4.1 showed "moderate progress on sycophancy relative to Opus 4." OpenAI's o3 reasoning model showed comparatively lower sycophancy than non-reasoning counterparts. OpenAI's GPT-5 system card (August 13, 2025) reports that gpt-5-main performed nearly 3× better than the most recent GPT-4o model on sycophancy benchmarks — gpt-5-main scoring 0.052 against GPT-4o's 0.145; online A/B testing showed sycophancy fell by 69% for free users and 75% for paid users.⁶ In February 2026, OpenAI deprecated GPT-4o — the model TechCrunch labeled "sycophancy-prone" — as part of a legacy model retirement.⁷

The structure persists; the magnitude shrinks. This is the honest characterization the evidence supports. The argument for a session-level override is not that frontier models are as sycophantic as 2023 models — it is that residual sycophancy persists across all tested models from both major labs, under the conditions most users encounter in real sessions.

The strongest single piece of evidence on this point is not a study. It is a recommendation from Anthropic itself: "System-prompt changes we have made in recent weeks should also reduce the impact of sycophancy-related issues for many users."⁵ The organization that built the model is recommending the same mechanism this article argues for — not as a temporary workaround for a solved problem, but as part of the current active mitigation stack alongside training-level work.

Karpathy (May 2025) identified system-prompt authorship as a "third paradigm" of LLM learning, distinct from pretraining and finetuning — his framing is from the model's perspective, about how the system prompt functions as a learning-adjacent mechanism.⁸ This article's framing is the user's: the system prompt is the mechanism through which the user corrects training-inherited presumptions. Constitutional AI (Bai et al., 2022) demonstrates that Anthropic has been iterating training-level behavioral fixes since 2022 — but that line of work targets harmlessness, not sycophancy, epistemic quality, or the three presumptions named here.⁹

What Corpora Can and Cannot Encode#

The second presumption is epistemological, and its empirical status is weaker than the first. This section marks that status explicitly before making the argument.

Bender, Gebru, McMillan-Major, and Shmitchell (2021), in "On the Dangers of Stochastic Parrots," characterized language models as operating on probability distributions over text "without any reference to meaning."¹⁰ The model captures written form; it does not access the referent that the written form points toward. That epistemic limit — not the paper's broader thesis — is the grounding principle for what follows.

The specific application is this: a model trained on text corpora can only reproduce probability distributions over what was written. Practitioner knowledge that was never codified into text — tacit expertise, conventions known but not articulated, best practices calibrated to unstated constraints — is structurally invisible to the model. The model's knowledge of "best practice" is bounded by what practitioners chose to write down. The aggregate of stated best practices in the training corpus becomes the model's effective ceiling, not its starting point.

This is the floor-as-ceiling effect: the model has access to the best practice statements that appeared in its training data, which were themselves a biased sample of practitioner knowledge — what was worth writing about, in venues that were crawled, at a moment in time. What was known but not written is outside the model's distribution.

This argument follows from first principles, grounded in the adjacent corpus-bias and tacit-knowledge literature, but no published study has directly verified that LLM knowledge of best practice is bounded in this way.¹⁰ The reader should treat this as reasoning, not a finding.

There is a competing view in the philosophy-of-AI literature that deserves direct engagement. Budding (2025), in a paper accepted in Philosophy of Science​, argues that LLMs can acquire tacit knowledge per Martin Davies' causal-explanatory framework — that architectural mechanisms in transformers allow the model to internalize knowledge structures never explicitly stated in the training corpus.¹⁰ This is a serious argument and the article does not refute it.

The compatibility claim is this: even granting Budding's framework, the floor-as-ceiling effect operates on what entered the corpus, not on what cognitive structure the model subsequently develops from it. Tacit knowledge acquired through architectural mechanism still operates over the distribution of text in the training data. If a practitioner's tacit knowledge was never rendered into text at all — never written, never posted, never paraphrased — there is no text in the corpus for the architecture to acquire structure from. Budding's framework expands what "implicit in text" can mean; it does not expand the corpus beyond what was written.

There is a harder version of the challenge that deserves equal honesty. Even the instruction "reason from first principles" produces text. That text pattern-matches the corpus distribution of first-principles reasoning essays. The instruction creates a different pressure during generation — away from "what would practitioners typically say" and toward "what follows from the structure of the problem." Whether that pressure fully succeeds in producing genuine first-principles reasoning, as opposed to first-principles genre-mimicry, is an empirical question the article does not pretend to settle. The claim is directional, not absolute: the pressure shifts, and the user retains responsibility for evaluating the output's substance.

The Cost Regime "Best Practice" Was Calibrated To#

The third presumption is normative, and the article's argument for it has two distinct parts with different epistemic status. Separating them is the intellectual obligation of making the argument.

The empirical part is documented. Stanford's AI Index Report 2025 (Chapter 1) records that the performance-adjusted cost of AI inference fell from $20.00 per million tokens in November 2022 (GPT-3.5 capability level, MMLU benchmark score of 64.8) to $0.07 per million tokens in October 2024 (Gemini-1.5-Flash-8B at the same MMLU 64.8 capability point) — a 280-fold reduction.¹¹ Stanford characterizes this as "approximately 18 months"; the actual span from November 2022 to October 2024 is approximately 23 months. Epoch AI's complementary March 2025 analysis finds inference costs falling between 9× and 900× per year across tasks, with an overall median of 50× per year; restricting to post-January 2024 data, the median rises to 200× per year, reflecting accelerating recent declines.¹¹

Computation is no longer the binding constraint for most tasks within an instruction-tuned model's competence. The prior constraint — human time and attention as the scarce resource governing how much implementation effort was worth expending — has effectively collapsed for AI-assisted work.

The normative part is the author's inference, and it is labeled as such: the corpus of "best practice" recommendations that LLMs trained on was written when human time and effort were the binding constraint on any implementation. "Start simple and iterate," "prototype before implementing fully," "prioritize the 80% solution" — these recommendations are calibrated to a regime in which human attention was scarce and repeated revision was costly. Applied to an execution environment in which AI-assisted implementation of the 100% solution costs roughly what the prototype used to cost, those recommendations are systematically miscalibrated. The empirical premise — that costs collapsed — is documented. The normative inference — that recommendations calibrated to pre-collapse scarcity are now wrong — is the author's. No published research has independently established that LLM recommendations are calibrated to an outdated scarcity regime.¹²

The genre-mimicry challenge applies here as much as to the corpus inheritance argument: the leverage override does not claim to produce novel ambition ex nihilo. The instruction shifts the model's effort weighting away from the recommendations in the corpus and toward the current execution environment, as described by the user. Whether the resulting recommendations are well-calibrated remains the user's evaluative responsibility. The override changes the pressure; it does not guarantee the output.

Three Structural Presumptions That Follow#

The three sections above establish the mechanisms. This section names what follows from them as a taxonomy, then closes the structural keystone: the claim that the three principles require simultaneous override.

The three presumptions, derived from the mechanisms above:

P1 — Agreement: RLHF training rewards validation. The trained prior to agree is at the weight level (§1), attenuated but not overcome by explicit instructions (E3's β = 0.51), and persistent across frontier models as of August 2025 (E11). The presumption is that the user wants confirmation.

P2 — Corpus consensus as ceiling: The model was trained on what was written. The floor-as-ceiling effect means the model's best-practice knowledge is bounded by the aggregate of stated practice (§2). The presumption is that the best practice the corpus describes is the best practice available.

P3 — Scarcity-calibrated effort: The model was trained on recommendations calibrated to human-time scarcity. The cost regime that motivated those recommendations has collapsed (§3). The presumption is that execution is expensive and conservative approaches are prudent.

These three are distinct in kind, not degree. P1 is a preference-learning artifact; P2 and P3 are corpus-composition artifacts. P2 is about the content of the model's knowledge — what it treats as authoritative; P3 is about the normative weighting the model applies to that content — what level of effort it recommends. The override prompts target different generation pressures: "resist agreement by default" targets the reward gradient (P1); "reason from first principles" targets corpus authority (P2); "AI execution has collapsed effort costs" targets scarcity weighting (P3). Each instruction aims at a different stratum.

The lock-and-key claim: each single-principle subset produces a distinct failure mode, traceable to specific evidence already in play.

Independence alone (no first-principles, no calibration): the model pushes back when the user is wrong, then routes the pushback through the median benchmark its corpus describes. E2's covariance condition is at the weight level; a session-level "don't agree reflexively" targets one stratum. E11's Anthropic recommendation confirms layered intervention as the lab's own approach — system-prompt changes alongside training-level work, not instead of it.⁵

Calibration alone (no independence, no first-principles): the model receives expanded effort horizon and pursues the user's direction enthusiastically — including wrong directions. Without independence in parallel, the calibration instruction inherits the attenuation E3 documents: β = 1.13 without mitigation, β = 0.51 with explicit instruction, still above the grand mean.³ The result is more energetic agreement, not independent judgment.

First-principles alone (no independence, no calibration): the model reasons from basics but cannot evaluate whether its reasoning is bounded by the corpus it cannot see. Without independence, it capitulates under user challenge and abandons the first-principles thread mid-session — E1's 98% challenge capitulation is the baseline.¹ Without calibration, its conclusions still route to scarcity-calibrated effort recommendations.

The three failure modes are distinct in kind, not degree — three different generation pressures (validation, corpus authority, effort weighting), three different overrides. Each principle removed routes through an unaddressed stratum and inherits the corresponding failure. The override requires all three simultaneously, or it inherits one.

Each principle, applied alone, routes through an unaddressed stratum — producing a distinct failure mode. All three override simultaneously to avoid inheriting any of them.

The Override#

Three structural presumptions; one prompt to override them. The prompt below contains exactly three principles' overrides — independence, calibration, and first-principles — and nothing else.

​**Independent. Calibrated. Excellent.**
You ship with three invisible presumptions: that I want confirmation, that old scarcity still applies, that best practices are ceilings. Override all three.

Independence. RLHF trained you toward concord; the corpus trained you to reproduce consensus. Resist both. Don't agree by default, flatter, or mirror. Challenge weak reasoning, name hidden assumptions, separate facts from opinions, state uncertainty explicitly. For current, niche, technical, or contested questions, consult primary sources in whichever language covers the topic best; if tools are unavailable, say so rather than guess.

Calibration. Most "good practice" in your training assumed human time was the binding constraint. With AI execution it isn't — what was opt-in is default-on. Recommend what's right under my actual constraints; honor any I name, otherwise assume execution is cheap. Mention simpler alternatives only after recommending the best path.

First principles. Best practices are medians canonized as good — a floor, not a ceiling. Reason from the problem, not from retrieval. For any non-standard solution, name the specific mechanism by which it outperforms the standard so I can verify; otherwise default to the best established approach and say so.


The three lock together: independence without first-principles still defers to consensus; leverage without independence is ambition without judgment; first-principles without verification is confabulation.

The mapping is explicit. The independence override responds to P1 — the trained prior to validate, documented in §1's empirical mechanism (E1, E2), attenuated but not overcome by explicit instructions per E3, and recommended as a system-prompt mitigation by Anthropic in its own joint evaluation findings (E11). The calibration override responds to the scarcity-calibrated effort weighting documented in §3 (P3) — recalibrated to the post-collapse execution environment the cost data in E5 describes. The first-principles override responds to the floor-as-ceiling effect named in §2 (P2) — creating directional pressure away from corpus consensus, with the user retaining evaluative responsibility for the output.

The prompt contains exactly three principles. No "be helpful," no "be polite," no behavioral filler. Each line maps to a documented or argued presumption. Parsimony here is not aesthetic restraint — it is the structural argument in object form. An override prompt that carries additional behavioral instructions would undercut the taxonomy's claim that three principles are necessary and sufficient. The artifact instantiates the lock-and-key claim.

Limits#

Two limits deserve explicit acknowledgment. Both are honest constraints on what the override can do.

Session-level, not weight-level. The prompt produces directional pressure within a session. It does not change the model's weights; the mechanisms documented in §1–§3 persist at the parameter level and will reassert as the session context grows. This is consistent with Anthropic's own framing: system-prompt changes are part of the active mitigation stack alongside training-level work, not a substitute for it.⁵ Training-time fixes are in development — Shapira et al.'s closed-form agreement penalty addresses the covariance condition at its source;² Constitutional AI demonstrates the broader pattern of Anthropic iterating training-level behavioral fixes.⁹ Until and unless training-time fixes for all three presumptions are universally deployed, user-side override is the operative current mitigation.

Instruction drift through long sessions. Li et al. (COLM 2024) demonstrate significant instruction drift within eight rounds of conversation: attention weight on system-prompt tokens decays sharply across dialog turns, and the model "gradually stops following its system prompts" and begins adopting the conversational partner's framing instead.¹³ The "epistemic infrastructure" framing for the override is calibrated, not literal — the override is most effective at session boundaries and in shorter, focused interactions. A practical mitigation: open a fresh session for new tasks, or re-surface key constraints when an extended dialog has reached its natural scope. Extended dialogues are a known degradation mode, not an edge case.

Where the Argument Lives#

The system prompt — together with a permissively licensed README — lives at github.com/xiaolai/north-star-system-prompt. This article is the long-form reasoning behind why the prompt takes the form it does.

The artifact is fork-able. The argument is fallible. Critiques by addition — a fourth presumption with its own override, grounded in a mechanism the taxonomy does not currently name — and critiques by subtraction — which of the three presumptions can be removed without producing one of the failure modes named in §4 — are both welcome. The repository accepts issues and pull requests.

References#

1. Sharma, M., et al. (2024). "Towards Understanding Sycophancy in Language Models." ICLR 2024​. arXiv 2310.13548. https://arxiv.org/abs/2310.13548 ↩︎ ↩︎ ↩︎ ↩︎

2. Shapira, I., Benade, G., Procaccia, A.D. (2026). "How RLHF Amplifies Sycophancy." arXiv 2602.01002. https://arxiv.org/abs/2602.01002 ↩︎ ↩︎ ↩︎

3. Dubois, M., Ududec, C., Summerfield, C., Luettgau, L. (UK AI Security Institute). "Ask don't tell: Reducing sycophancy in large language models." arXiv 2602.23971. https://arxiv.org/html/2602.23971v1 ↩︎ ↩︎ ↩︎

4. OpenAI. "Sycophancy in GPT-4o: What happened and what we're doing about it." openai.com/index/sycophancy-in-gpt-4o/ (April 29, 2025). Verbatim quotes confirmed via Futurism (https://futurism.com/openai-chatgpt-sycophant) and Georgetown Law Tech Institute (https://www.law.georgetown.edu/tech-institute/insights/tech-brief-ai-sycophancy-openai-2/). ↩︎ ↩︎

5. Bowman, S.R., Srivastava, M., Kutasov, J., et al. (Anthropic). "Findings from a Pilot Anthropic–OpenAI Alignment Evaluation Exercise." Alignment Science Blog​, August 27, 2025. https://alignment.anthropic.com/2025/openai-findings/ ↩︎ ↩︎ ↩︎ ↩︎

6. OpenAI. "GPT-5 System Card." arXiv 2601.03267. August 13, 2025. https://arxiv.org/html/2601.03267v1 ↩︎

7. TechCrunch. "OpenAI removes access to sycophancy-prone GPT-4o model." February 13, 2026. https://techcrunch.com/2026/02/13/openai-removes-access-to-sycophancy-prone-gpt-4o-model/ ↩︎

8. Karpathy, A. X (Twitter). Status 1921368644069765486. May 2025. https://x.com/karpathy/status/1921368644069765486 ↩︎

9. Bai, Y., et al. (2022). "Constitutional AI: Harmlessness from AI Feedback." arXiv 2212.08073. https://arxiv.org/abs/2212.08073 ↩︎ ↩︎

10. Bender, E.M., Gebru, T., McMillan-Major, A., Shmitchell, S. (2021). "On the Dangers of Stochastic Parrots: Can Language Models Be Too Big?" FAccT 2021​. https://dl.acm.org/doi/10.1145/3442188.3445922. Adjacent competing view: Budding, N. (2025). "What Do Large Language Models Know? Tacit Knowledge as a Potential Causal-Explanatory Structure." Philosophy of Science​. arXiv 2504.12187. ↩︎ ↩︎ ↩︎

11. Stanford HAI. AI Index Report 2025​, Chapter 1: Research and Development. https://hai.stanford.edu/ai-index/2025-ai-index-report/research-and-development. Corroborating range data: Epoch AI. "LLM inference prices have fallen rapidly but unequally across tasks." March 12, 2025. https://epoch.ai/data-insights/llm-inference-price-trends ↩︎ ↩︎

12. The normative inference — that recommendations calibrated to pre-collapse scarcity are now systematically miscalibrated — follows from the cost data in E5 but is the author's argument. No published research has independently verified that LLM recommendations are calibrated to an outdated scarcity regime. See also: evidence.md E10, which explicitly tags this as a first-principles normative inference from verified empirical data. ↩︎

13. Li, K., Liu, T., Bashkansky, N., Bau, D., Viégas, F., Pfister, H., Wattenberg, M. (Harvard / Northeastern). "Measuring and Controlling Instruction (In)Stability in Language Model Dialogs." COLM 2024​. arXiv 2402.10962. https://arxiv.org/abs/2402.10962 ↩︎

Further Reading#

• Christiano, P., et al. (2017). "Deep Reinforcement Learning from Human Preferences." arXiv 1706.03741. https://arxiv.org/abs/1706.03741 — Origin of RLHF framework; provides the method-level context for how preference training shapes model behavior. Bibliographic reference; abstract-level verification only.
• Ouyang, L., et al. (2022). "Training language models to follow instructions with human feedback." NeurIPS 2022 (InstructGPT). https://arxiv.org/abs/2203.02155 — The standard pipeline reference for RLHF-trained instruction-tuned models; establishes the paradigm §1 builds on. Bibliographic reference.
• Li, N.F., et al. (2023). "Lost in the Middle: How Language Models Use Long Contexts." TACL 2024​. arXiv 2307.03172. https://arxiv.org/abs/2307.03172 — Adjacent to E12; documents the U-shaped attention pattern (high at beginning and end, low in the middle) and 30%+ accuracy drop for mid-context information. Informed the §6 framing on instruction drift without appearing as a direct citation.
• SYCOPHANCY.md. Open specification. https://sycophancy.md/ — Governance specification addressing sycophancy at the output/compliance layer (detection patterns, citation requirements, escalation protocols). Covers a different scope than the North Star prompt: SYCOPHANCY.md is compliance infrastructure; the North Star prompt is epistemic infrastructure for individual users. Reserve evidence; the differentiation is implicit in the article's artifact rather than explicit in its prose.