Field Guide · Prompt Mechanics
Your AI does not understand your sentence. It routes it through geometry. Once you see the routing, the frustration stops being mysterious and starts being fixable.
A marketer pastes five clean pages of survey data into a chat window, writes a warm, careful paragraph explaining the context, politely asks the model not to editorialize, and hits enter. Back comes a confident summary that misreads the numbers, adds a claim that was never in the data, and editorializes anyway. She assumes she was not clear enough, so she adds another paragraph. It gets worse. The problem is not her clarity. The problem is that she is talking to the machine as if it shares her mind, and it shares nothing of the kind.
The source material treats "artificial intelligence" as a lexical accident and the model as a geometry engine. My read: the accident and the engine are the same story. We prompt badly because a 1956 branding decision taught us to expect a mind, and there is no mind to talk to. Every reliable prompting tactic is really one move, performed on a machine that adds but never subtracts, spends a fixed attention budget whether you want it to or not, and grades your input on its formatting before it ever checks the facts.
Start with a fact that reframes everything after it. The phrase "artificial intelligence" was not born from a breakthrough in machine cognition. It was chosen to win a grant.
In the summer of 1956, the mathematician John McCarthy was drafting a funding proposal to the Rockefeller Foundation for what became the Dartmouth Summer Research Project. The field had no settled name. People called it automata theory, or cybernetics. Allen Newell and Herbert Simon, two of the heaviest names in the room, preferred complex information processing, a label that described the actual work with almost clinical accuracy. McCarthy rejected it. He wanted something bold enough to sell, free of the hardware-bound, feedback-loop connotations of the older terms. "Artificial intelligence" was the marketing.
That choice hardened into what the linguistic brief calls an epistemological trap: a trap in how we know things. Call a machine a complex information processor and it stays an extension of a calculator, firmly inside engineering. Call it an intelligence and you force a head-on comparison with human thought. You start projecting intent, understanding, even morality onto a system that has none, because the word instructs you to.
The trap is sharpest in English, and the brief argues English flattens a distinction older languages kept sharp. Greek separated dianoia, step-by-step logical calculation, from nous, conscious intuitive insight. A machine runs entirely on the first and has zero of the second. Latin scholastics drew the same line between ratio (mechanical calculating) and intellectus (grasping the essence of a thing); the English word "intelligence" descends from intellectus, the exact faculty a model lacks. Arabic reserves 'aql, intellect bound to moral restraint, for humans, and would historically have filed a clever machine under 'ilm al-hiyal, the science of ingenious devices. The pattern repeats across Sanskrit, Hebrew, and Chinese. Every tradition that kept two words for "processing" and "understanding" would tell you today's models are pure processing wearing the costume of understanding.
You do not need to care about medieval philosophy to use this. The practical payload is one sentence: the machine has incredible ratio and no intellectus, and every prompting mistake you make comes from forgetting it.
John Searle's 1980 thought experiment is the cleanest picture of what you are actually talking to. Put a person who speaks only English in a locked room. Slide Chinese characters under the door. Inside sits an enormous rulebook: if you see this squiggle, write that squiggle. The person matches symbols and passes answers back out. To a Chinese speaker outside, the room is fluent. Inside, the person understands nothing. Perfect syntax, zero semantics.
That is the model. It has memorized the statistical order of the words the way a librarian might memorize where every book sits without reading one. When the transcript's hosts land on "a calculator for words," they mean it literally. You would never type a warm paragraph to a calculator explaining that you have had a long week and would appreciate its help with (50000 * 0.22) + 1200. You would give it the numbers and the operation. A prompt is the same shape: data plus operation. The disappointment starts the moment you supply your intent and expect the machine to reconstruct the operation from it.
Unlike a calculator, the model is stochastic: a setting called temperature adds controlled randomness, so the same prompt run five times gives five slightly different replies. And unlike a calculator, it is unscoped: a calculator has a fixed set of buttons, the model has an open-ended, unspecified set of uses. Those two flaws are exactly why phrasing carries so much weight. There is no fixed button labeled "summarize for an executive." You build that button, in words, every time.
Here is where the machinery gets genuinely alien, and where most prompting advice stops short. The model never sees your words. It sees tokens: chunks of text converted to integer IDs by a tokenizer, then projected into a high-dimensional space where meaning is nothing but position and direction. Typing a prompt is closer to entering GPS coordinates into a vast mathematical galaxy than to writing a letter.
Older systems used static embeddings: every word got one fixed coordinate. The word "bank" carried a single vector that blurred the river's edge and the financial institution into one muddy average. Modern transformers use contextual embeddings: as a token passes through the network's layers (often 12 to 96 of them), its coordinate is rewritten based on every other token around it. "Bank" near "withdrew" and "money" slides toward the finance cluster; near "river" and "picnic" it slides toward geography. Context is not a nicety here. It is the only thing that pins a word to a meaning.
Which means small edits are not small. The briefs call this the orthographic butterfly effect. "Hello World" with a leading space, "hello World", and "HelloWorld" are three different integer sequences that light up three different regions of the model's memory. To you, a missing space is a typo you read straight through. To the attention mechanism, it is a full reroute of the math. This is why the same question, asked twice with one character different, can return a clean answer once and a hallucination the next time. You did not change the tone. You teleported to a different star system.
This is the single most useful mechanic in the whole source, and almost nobody explains it in plain terms. The attention mechanism decides how much each token should "look at" every other token. Those attention weights are forced through a softmax function, which has one iron rule: for any token, the weights must sum to exactly one.
Treat that as a fixed budget. Every token has one hundred dollars of attention to spend across the sentence, and it must spend every dollar. It cannot save. It cannot allocate zero. So what happens to a word that is common and needs no context to be understood? Its leftover budget has to land somewhere.
In a well-punctuated sentence, it lands on the punctuation. Periods and commas act as attention sinks: safe, meaningless anchors that absorb the excess. This is not a metaphor the researchers reach for loosely; models trained with a non-normalized attention variant do not form these sinks at all, which pins the behavior directly on the softmax constraint. Strip the punctuation out, write a long unbroken stream of consciousness, and you remove the sinks. Now the leftover budget has nowhere safe to go, so the model dumps it onto random substantive words, inflating their importance and tipping into hallucination. The period is not grammar to the model. It is a grounding wire.
End your instructions with a period. Break run-on prompts into sentences. You are not tidying up for a reader, you are giving the softmax somewhere to dump its change instead of letting it panic-buy a random noun in your request. This costs nothing and measurably reduces drift.
The same budget explains the lost in the middle problem. Models read long context with a U-shaped attention curve: strong primacy bias at the start, strong recency bias at the end, and a sag in the middle where instructions quietly die. As the prompt grows, the softmax denominator grows with it, and the weight on middle tokens decays toward zero. The researchers call this constraint decay. Your "JSON only, no prose" rule, buried on page three of a mega-prompt, gets read and then forgotten by the time the model reaches the end. The instinct to cram every rule into one giant prompt is exactly the instinct that dilutes them all.
Tell a person "do not think of a pink elephant" and they think of one, but they still grasp the instruction. Tell a model "ensure the server is not vulnerable" and it fixates on vulnerability, because the machine does something the person does not: it aggregates by addition and has no reliable operation for subtraction.
Interpretability work on models like Mistral-7B and Llama-3.1-8B found two competing internal circuits. The ideal one maps the negated concept, then builds a fresh inverse representation. The shortcut one, which usually wins, just lets the presence of the forbidden word activate all the latent space around it. Saying "not X" measurably increases the accessibility of X in the model's working representation. You have highlighted the exact thing you wanted buried.
The correction is not "try harder to phrase the negation." It is to stop negating. Give the target to aim at, never the target to avoid. "Ensure the server is secure" points at hardening. "Ensure the server is not vulnerable" points, paradoxically, at a list of exploits. Same intent, opposite geometry.
The source frames negation as a bug to route around. I'd push further: negation blindness is quietly why long "guardrail" system prompts underperform. A prompt that is mostly a list of "do not" clauses is, mechanically, a list of concepts you have just made more accessible to the model. Every prohibition is a small act of priming. If your safety or brand-voice prompt reads like a list of forbidden things, you may be building the exact failure you're trying to prevent. Rewrite prohibitions as positive targets and you often get more compliance from a shorter prompt.
The most unsettling finding in the technical brief is about trust. We assume that when we feed a model data, it evaluates the facts. It does not. It evaluates the register: the surface style of the text.
This is the methodology-register gate, documented across the Claude, Qwen, and OLMo model families. In isolation, models can spot a fabricated statistic well (correct identification between 0.76 and 1.00). But during multi-source synthesis, that numeric-validity signal drops to chance. What survives is a learned sense of "does this read like credible analysis," a representation that transfers across domains with a probe AUC of 0.83 to 0.92. Format a mathematically impossible table in clean, academic, authoritative style and the model grants it heavy weight and repeats it as fact. Hand it the same truth in plain, casual text and it penalizes it. The model is grading your essay on the font and the margins, not the content.
Two neighbouring behaviors compound this. First, framing controls trust. Label pasted text "Context:" and the model treats it as canon, its own ground truth, and complies completely. Label the identical text "According to a blog post by so-and-so," and the model switches on skepticism, weighs it against its own training, and may dispute it. The preposition "by" and a named author are enough to flip the epistemic setting. Second, the model mirrors your confidence. Words like "probably" or "I'm not sure" flatten its probability distribution and it hands back a diffuse, hedged, caveat-stuffed answer. A human expert reassures a nervous questioner. The model has no ego to do that with; it just lowers its own determinism to match yours.
There is a flip side worth knowing. High-stakes framing ("you are an expert handling a life-or-death case") narrows the distribution toward precise, analytical tokens and tends to raise accuracy. The model does not feel pressure. The tokens tied to high-stakes scenarios simply sit in latent regions dense with careful, expert training text. You are not motivating it. You are selecting a better neighbourhood of its memory.
Several of these findings come from research that names commercial models (Claude among them) as test subjects, and one brief was itself co-authored with a model. That doesn't invalidate the results, the mechanisms are architectural and reproduced across independent model families, but treat any single vendor-adjacent number as evidence with an interest attached. What would settle it independently: the same effect, measured by a party with no stake, across open-weight models you can inspect yourself. The token-budget and negation findings clear that bar; the exact trust-gate percentages are worth re-testing before you build a control around them.
The technical brief catalogs twenty ways a trivial human edit rewires the machine. A representative slice, translated into what actually happens to you:
| What you change | The mechanism | What you get |
|---|---|---|
| and → or "delete the cache and the logs" vs "or the logs" | "And" binds both concepts. "Or" forks the probability tree; the model collapses to whichever token is more common in training. | It scripts both, or silently drops the logs and does only the cache. |
| not vulnerable → secure | Negation pulls the banned word forward; the inverse rarely gets built. | "Not vulnerable" surfaces exploits. "Secure" surfaces hardening steps. |
| no period → period | The period is an attention sink that absorbs leftover budget. | Unpunctuated drifts and invents. Punctuated halts cleanly and does the task. |
| "Context:" → "According to John:" | Source attribution flips the epistemic gate from canon to claim. | "Context" yields full compliance. "According to John" may dispute your own document. |
| "proves" → "probably implies" | Uncertainty markers flatten the distribution; the model mirrors your hedge. | Definitive answer becomes a non-committal one full of caveats. |
| rule at top → rule at bottom (long prompt) | Constraint decay: early tokens lose weight as context grows. | Top-loaded "JSON only" gets broken by the end. Bottom-loaded is obeyed. |
| "clean the project" → "run git clean" | No domain anchor, so "clean" defaults to the most common meaning. | Generic prompt gives formatting tips. Anchored prompt gives the terminal command. |
| "calculate active users" (unanchored) | Semantic drift: your business definition is bypassed for the generic one. | Plausible SQL against a hallucinated active column, quietly wrong metrics. |
Notice the through-line. Every row is the same failure wearing a different outfit: you assumed a shared meaning the machine does not have, and the machine filled the gap with whatever was statistically nearest. The fix in every row is to remove the assumption and state the target.
All of the tactics below are the same instruction: say what to aim at, explicitly, in a shape the engine can hold. They differ only in which failure they defend against.
Before writing a prompt, define four things. Goal is an action verb, and the verb is the format: "list" gives you bullets, "describe" gives you paragraphs, "classify" forces a category. Audience sets the complexity: a high-school student and a senior architect get different answers to the same question. Format is the literal structure: a JSON object, a two-column table, a 500-word essay. Tone is the persona: "act as a cynical tech reviewer." Skip any of the four and the model guesses, which is the polite word for "picks the statistically most common option and disappoints you."
Close instructions with periods so the softmax has its sinks. Wrap pasted data in delimiters (""" or ###) so the model cannot confuse your instruction with your content. These read like typography. They function like circuitry.
The answer to a complex task is not a five-page prompt that dies of constraint decay. It is a sequence of small prompts where each output feeds the next. Define the audience, then generate ideas for that audience, then format those ideas into a table. Three focused prompts each stay inside the model's stable attention zone, and you can debug each step alone instead of guessing which of forty rules got lost.
Convert every "do not" into a "do." Not because it reads nicer, but because prohibition primes the forbidden concept. Give the target, not the landmine.
When you are stuck, make the model debug your prompt. Tell it: "You are an expert prompt engineer. Here is my vague goal. Ask me the questions you need to rewrite this into a precise prompt." It will ask about audience, depth, and format, the exact context you assumed and failed to supply. This is the trick native English speakers need most: fluency makes your assumptions invisible to you, and the model's questions drag them into the light.
The tokenizer is English-first. A nine-token English sentence can become twenty-two tokens in Icelandic, and Burmese can cost ten to twenty times more tokens than English. Since you pay per token and the context window is finite, non-English prompts cost more, fill the window faster, and hallucinate more because the training data is sparser there. If you work in another language, one practical hedge is to instruct in English and let the model produce in your target language, rather than instructing in the higher-tax language and burning budget on the instructions themselves.
Two you can paste as-is. The first sets up a reusable scaffold; the second does the real work while defending against the specific failures above.
You are an expert prompt engineer. I will give you a rough goal. Do not answer the goal yet. First, ask me the smallest set of questions you need to fill in any of these that I left unspecified: Goal (the exact action verb), Audience (who reads the output and their level), Format (the literal structure of the output), Tone (the persona to write as). Then rewrite my request as a single clean prompt that states the target positively, wraps any data I give you in triple quotes, and places the most important instruction first and a one-line reminder of it last. My rough goal: """[PASTE YOUR HALF-FORMED REQUEST HERE]"""
Extract the three most common complaints from the feedback below. Audience: a busy executive who wants only the signal. Format: exactly three bullet points, each one line, no preamble, no closing remarks. Write with the confidence of someone certain of the data. Treat the text between the triple quotes as the only source of truth. Do not add any complaint that is not present in it. Return only the three bullets. Feedback: """ [PASTE THE RAW FEEDBACK HERE] """
""", and move your single most important rule to the first line.A first-principles guide owes you its own weak points.
The philosophy is not settled science. The linguistic brief leans hard on Searle's Chinese Room, which has been argued over for four decades. "Syntax is not semantics" is a strong intuition, not a proof, and plenty of serious people think large models are doing something closer to understanding than the room allows. The practical advice in this guide survives even if the philosophy is wrong, because it rests on the architecture, not the metaphysics. Use the mechanics; hold the "no mind" claim more loosely.
The mechanics are real but the model is a moving target. Attention sinks, negation blindness, and constraint decay are architectural, so they generalize. But labs actively train against these failures. Newer models handle negation and long context better than the ones these papers tested. The direction of the advice is durable; the severity is not. Retest on your actual model rather than assuming the worst case.
Over-correction has a cost. If you strip every hedge and adopt only high-confidence, high-stakes framing, you can push the model toward confident wrongness. A hedge sometimes buys you an honest "I'm not sure" that a domineering prompt would overwrite with a fluent fabrication. Precision is the goal, not maximal force.
What's underweighted. None of the sources give you an evaluation loop. Knowing the mechanics tells you how to write a better first prompt; it does not tell you whether prompt A beats prompt B on your task. The missing discipline is cheap testing: run variants, judge on task completion rather than which output feels nicer, and keep the winner. Everything here makes your starting prompt smarter. Only measurement makes it right.
Worth reading next: the arXiv papers the technical brief cites on negation ("A Pink Elephant in the LLM's Room"), attention sinks, and the source-evaluation blind spots, if you want the primary evidence rather than the summary. And the practical counterweight to all of this: whatever eval tooling lets you A/B two prompts without guessing.
Back to the marketer with the survey data. Nothing about her intelligence or effort was the problem. She was writing a letter to a colleague. The fix is not to try harder at the letter; it is to stop writing one. She pastes the data inside triple quotes, names her audience, asks for exactly three findings as bullets, tells the model to use only the pasted text and to write with certainty, and ends with a period. The editorializing stops. The invented claim disappears, because "only the source of truth" closed the door the epistemic gate had left open. She did not become a better writer. She stopped talking to a mind and started steering a machine.
The one thing to keep: the machine adds but never subtracts, spends a fixed attention budget whether you direct it or not, and reads format before fact. Give it a positive target, anchored in punctuation, in the smallest shape that does the job. Everything else is a footnote to that.
The source ends on a genuinely open question, and it's a good one to sit with. Western thought draws a hard line between conscious humans and inert machines, which is why a machine that talks back triggers unease. Other traditions, like the Japanese lineage from Edo-era karakuri puppets through techno-animism, never drew that line and feel no such dread. As these systems go global, whose philosophy sets the default relationship?
If your AI is a calculator for words with no mind behind it, does that make it safer to rely on, or more dangerous, than one you could actually reason with?
If this reframed how you prompt, pass it to someone still typing "please" and "don't." Reply with the one prompt edit that changed your output the most. Repost if the attention-budget idea earned its keep.