作者开源了一个黑盒提示词消融工具,通过逐句遮蔽提示词来识别哪些句子实际驱动了模型输出,帮助调试 Agent 和审计第三方模型行为。
大多数可解释性研究都假设你拥有模型权重,但生产环境中的工程师通常只能通过 API 访问。本文我们将构建一个黑盒 prompt 消融工具,用于识别 prompt 中哪些句子真正驱动了模型的输出。该工具可用于调试 Agent、审计 system prompt,或理解第三方模型的行为。
依赖安装:
pip install openai
需要一个来自 https://portal.oxlo.ai 的 Oxlo.ai API key。
首先初始化 Oxlo.ai 客户端。由于 Oxlo.ai 完全兼容 OpenAI,唯一的区别是 base_url。
from openai import OpenAI
client = OpenAI(
base_url="https://api.oxlo.ai/v1",
api_key="YOUR_OXLO_API_KEY"
)
TARGET_PROMPT = """You are a travel assistant. The user is in a hurry and has a premium account.
User: I need a flight from NYC to London today. What is the best option?"""
为了隔离影响,我创建了 prompt 的掩码变体,每次将一个句子替换为 [...]。这是一种经典消融技术的适配版,适用于纯 API 访问的场景。
import re
def ablate_sentences(text: str):
sentences = re.split(r'(?<=[.!?])\s+', text.strip())
variants = []
for i in range(len(sentences)):
masked = sentences.copy()
masked[i] = "[...]"
variants.append(" ".join(masked))
return variants
ablations = ablate_sentences(TARGET_PROMPT)
print(f"Generated {len(ablations)} ablated variants")
我将 temperature 设为 0.0,使不同运行之间的差异来自消融本身而非采样噪声。我使用 deepseek-v3.2,因为它速度快且推理能力出色;同时 Oxlo.ai 按请求计费而非按 token 计费,这意味着我可以批量运行二十个长 prompt 而无需担心费用随 token 数量增长。
def get_completion(prompt: str) -> str:
response = client.chat.completions.create(
model="deepseek-v3.2",
messages=[{"role": "user", "content": prompt}],
temperature=0.0,
)
return response.choices[0].message.content
baseline = get_completion(TARGET_PROMPT)
ablation_responses = [get_completion(v) for v in ablations]
分析器本身也是一个 LLM 调用。我使用强大的推理模型 kimi-k2.6,并通过严格的 system prompt 锁定其行为。
INTERPRETER_SYSTEM_PROMPT = """You are an LLM interpretability analyst.
You will receive a baseline prompt, its baseline response, and a set of ablated prompts with their responses.
For each ablation, state whether masking that sentence caused a meaningful change in content, tone, or structure.
Then summarize which sentences were most influential and explain why.
Be concise. Use bullet points."""
我将每个变体及其输出打包到同一个上下文窗口中,然后让解释器找出驱动因素。即使输入很长,kimi-k2.6 也能处理;而 Oxlo.ai 的按请求计费模式使我无论发送多少累积文本都能保持成本可预测。
analysis_input = f"""Baseline prompt:
{TARGET_PROMPT}
Baseline response:
{baseline}
Ablations:
"""
for idx, (variant, resp) in enumerate(zip(ablations, ablation_responses)):
analysis_input += f"\n--- Variant {idx} ---\nPrompt: {variant}\nResponse: {resp}\n"
response = client.chat.completions.create(
model="kimi-k2.6",
messages=[
{"role": "system", "content": INTERPRETER_SYSTEM_PROMPT},
{"role": "user", "content": analysis_input},
],
temperature=0.2,
)
report = response.choices[0].message.content
print(report)
将完整脚本保存为 probe.py 并在终端运行:
python probe.py
Generated 2 ablated variants
INTERPRETABILITY REPORT
- Variant 0 (masked "You are a travel assistant."):
Minimal change. The model still assumes an assistant role, likely due to the user question format.
- Variant 1 (masked "The user is in a hurry and has a premium account."):
SIGNIFICANT CHANGE. The baseline recommended an express business-class fare, while this variant returned a generic economy search. This sentence is the primary driver of urgency and upsell behavior.
Summary:
The model's output is most sensitive to the explicit persona and status cues. Removing urgency/premium context strips the recommendation of its prioritization logic. I recommend versioning this sentence carefully in production prompts.
这一模式适用于任何可以在 git 中版本化的 prompt。一个具体的下一步方向是将 probe 集成到 CI 任务中,当 prompt 编辑意外改变模型在 golden set 输入上的行为时让构建失败。对于更长的文档,可以换用具有 1M 上下文窗口的 deepseek-v4-flash,并且由于 Oxlo.ai 的按请求计费模式,无论消融多少文本成本都是可预测的。