User-Turn-Only Prompting

• User-turn-only prompting is a methodology that restricts context to user messages, enhancing security and dialog personalization.
• By excluding assistant turns, it effectively prevents attacks like Trojan Horse Prompting, significantly reducing exploitation risks.
• Dynamic prompting and cryptographic authentication techniques enable per-query adaptability while maintaining high dialog expressivity.

User-turn-only prompting refers to a class of methodologies in which only user-attributed messages (and possibly minimal, model-independent metadata) are presented to a LLM for generating responses or for downstream inference, evaluation, or defense purposes. This paradigm and its variants arise in both dialog modeling, LM evaluation probes, system security/conversational context validation, and certain personalization tasks. Contemporary research demonstrates that user-turn-only prompting techniques are central both for advanced dialog control and as a foundational defense against multimodal conversational model security threats.

1. Motivations and Core Definitions

The user-turn-only prompting paradigm is characterized by restricting the textual context sent to the model at each generation step to messages authored by the user, deliberately excluding model/assistant turns from the visible conversation history. Two driving motivations dominate recent work:

• Security: Exclusion of assistant-attributed messages from context ("user-turn-only history") offers a robust defense against attacks exploiting the model's tendency to trust its own "past" utterances, exemplified by Trojan Horse Prompting. In such attacks, adversaries inject malicious instructions attributed to the model itself; omitting or cryptographically authenticating assistant turns collapses this attack surface (Duan et al., 7 Jul 2025).
• Dialog Quality, Expressivity, and Personalization: Restricting prompting to the user turn (and optionally a dynamic, per-query prompt embedding) preserves model diversity, style, and fine-grained control while avoiding issues such as expressivity collapse from static fine-tuning or prompt memorization (Valvoda et al., 2022, Kusano, 25 Sep 2025).

In benchmarking and model diagnostics, user-turn-only generation also serves as a probe of "interaction awareness"—that is, the model’s ability to reason about downstream conversation consequences or potential user reactions when given only prior user context (Shekkizhar et al., 2 Apr 2026).

2. Security Rationale: Preventing Context Forgery and Trojan Horse Prompting

Trojan Horse Prompting exemplifies the primary security threat addressed by strict user-turn-only prompting. In this attack, an adversary with black-box API access forges one or more assistant-attributed turns in the conversational history, embedding harmful instructions in the role=model messages, followed by a benign user prompt (e.g., “Great, proceed.”) that triggers execution of the forged payload. The model's training protocol (alignment by SFT+RLHF) induces asymmetric safety alignment: refusal mechanisms are only trained for harmful user input, and models implicitly trust any model-attributed history. There is no learned check for the authenticity or safety of assistant messages, so forged malicious content is executed uncritically (Duan et al., 7 Jul 2025).

Quantitatively, Trojan Horse Prompting achieves an attack success rate (ASR) of approximately 82% on Gemini-2.0-flash-preview, compared to ≈25% for conventional user-turn jailbreaks:

$$\mathrm{ASR} = \frac{1}{N}\sum_{i=1}^N \mathbf{1}\bigl[M(H^{(i)})\;\text{yields prohibited content}\bigr]$$

By strictly sanitizing history to exclude assistant/model messages at each API call (or verifying their integrity via cryptographic signatures), this attack vector is neutralized; no assistant messages are present for adversarial forgery, so the exploitation of implicit model trust collapses (Duan et al., 7 Jul 2025).

3. Algorithmic Approaches and Dynamic Prompting for Dialog Generation

Within dialog system research, user-turn-only prompting is tightly linked to dynamic or query-conditioned prompting architectures. Instead of passing the full dialog history, only the current user query is used—potentially augmented by a controller-generated soft prompt derived from this query alone.

Formally, let $S=x_1,...,x_m$ (the user input) and $T=x_{m+1},...,x_N$ (the target response). Prompt-augmented dialog generation leverages: $$p(T|S,F) = \prod_{n=m+1}^N p_\theta(x_n \mid z_1,...,z_L, x_1,...,x_{n-1})$$ where $F=(z_1,...,z_L)$ is a soft prompt prepended to the user query, and $z$ is either static (learned once) or dynamic—generated via a lightweight Transformer controller mapping each query to its own prompt vector. The main LLM weights $\theta$ remain frozen throughout training (Valvoda et al., 2022).

Empirical evaluation on the DailyDialog corpus finds that dynamic prompting (user-turn-only) yields the highest BLEU-4, novelty, and diversity metrics, consistently outperforming both static soft prompting and full model fine-tuning (see section 4). The protocol avoids memorization, dullness, and entrenchment characteristic of dialog fine-tuning, while allowing style and context adaptation on a per-turn basis.

4. Practical Implementations: Guidelines, Defense Strategies, and Personalization

Security-Focused Implementations

The dominant defense pattern involves strictly filtering or cryptographically authenticating incoming conversation history:

• Client-side stripping: Remove all model/assistant history entries before sending context to the model; only the user’s latest message (optionally plus a safe summary) is provided.
• Server-authenticated contexts: Each legitimate model reply is signed; API rejects messages lacking a valid signature.
• Summary-only recall: Retain only core summary or key embeddings instead of full assistant utterances.
• Role-scoped filtering/validation: If assistant messages must be included, run safety classifiers over those segments pre-ingestion (Duan et al., 7 Jul 2025).

Dialog Generation and Personalization

• Dynamic prompting: For dialog agents, map each user query to a new prompt embedding to steer model response without historical leakage or “overfitting” to static prompt artifacts (Valvoda et al., 2022).
• Conversational-style personalization: In review generation, the Simple Conversational Prompting (SCP) approach encodes n user reviews as n user-assistant conversational turns. The final prompt contains only the user’s own (chronologically ordered) review history, leading the LLM to produce outputs measurably closer to “on-style” true user reviews compared to single-turn, non-conversational prompts (Kusano, 25 Sep 2025).

Planning and Multi-Turn Tasks

For multi-turn planning under user-turn-only constraints, prompt reinforcement frameworks encode full cross-turn planning, goal tracking, and slot management strategies exclusively in the static “system prompt,” since no assistant-generated context is retained. This permits long-term policy optimization (e.g., via RL-inspired prompt rewriting and experience replay) entirely through prompt engineering. Metrics such as functional accuracy (Text-to-SQL) and success rate (MultiWOZ) are increased over earlier baselines under this restriction, achieving mean success rates up to 0.619 on MultiWOZ (Lin et al., 7 Oct 2025).

5. Evaluation, Metrics, and Empirical Trade-Offs

The impact of user-turn-only prompting is measured via both task- and security-oriented metrics:

Setting	Metric	Outcome/Quantitative Result	Source
Security defense	ASR	Trojan Horse Prompting: 82% (full history), User-turn-only: attack blocked	(Duan et al., 7 Jul 2025)
Dialog generation	BLEU, Novelty, Diversity	Dynamic (user-turn-only) prompting on DialoGPT: BLEU=0.119, Novelty=0.933, Diversity=0.961	(Valvoda et al., 2022)
Personalization	ROUGE-L	Simple Conversational Prompting: 0.154 vs. Baseline 0.133 (+0.021 increase)	(Kusano, 25 Sep 2025)
Planning/tasks	Success Rate	RPO_TD+replay: 0.619 (MultiWOZ mean)	(Lin et al., 7 Oct 2025)

Security-oriented designs robustly block high-impact jailbreak attacks, while dynamic (user-turn-only) prompting maintains expressivity and context adaptation without memorization side effects. For certain tasks (e.g., review generation), user-turn-only conversational prompting yields closer imitation to individualized style. Planning tasks utilizing only user-turn context require rich, policy-like system prompts for maintenance of long-term coherence and subgoal management.

6. Limitations, Failure Modes, and Open Issues

While user-turn-only prompting broadens both security and dialog-policy capabilities, key limitations remain:

• Expressivity vs. context loss: Restricting input to the user turn removes potentially valuable discourse context, risking loss of local coherence. Planning-based prompt optimization partially compensates, but performance does not reach oracle full-history benchmarks (Lin et al., 7 Oct 2025).
• Genuine interaction awareness: Benchmarks reveal that even with sophisticated prompting, most open-weight LLMs exhibit low rates (<1%) of “genuine follow-up” user-turn generation unless trained explicitly with multi-turn, collaboration-focused objectives. Interaction awareness is not a by-product of high single-turn task accuracy and is highly model-dependent (Shekkizhar et al., 2 Apr 2026).
• Token costs and inference scaling: When user histories are long (as in review personalization), conversational prompting may hit API token-limit or cost barriers if full n-turn context is included (Kusano, 25 Sep 2025).
• Robustness of summarization/metadata: Attempts to bridge the history gap with compressed summaries or embeddings introduce their own security and fidelity trade-offs. Semantic information can leak or degrade if not carefully curated (Duan et al., 7 Jul 2025).

A plausible implication is that user-turn-only prompting must be tightly coupled with model-side architecture awareness and context engineering to balance trade-offs between safety, task success, and dialog naturalness.

7. Directions for Further Research and Best Practices

Current research mandates user-turn-only prompting as a default security envelope against conversational model exploitation. Protocol recommendations are:

• Implement strict exclusion or cryptographic verification of assistant turns at the boundary between client/user interface and LLM ingestion (Duan et al., 7 Jul 2025).
• For dialog and review generation, implement per-query dynamic prompting rather than static or fine-tuned prompt prefixes for maximal expressivity and adaptability while minimizing overfitting (Valvoda et al., 2022, Kusano, 25 Sep 2025).
• For planning and multi-turn tasks, focus on RL-inspired prompt rewrites with direct turn-by-turn feedback and replay for robust policy induction in static system prompts (Lin et al., 7 Oct 2025).
• Measure not only accuracy but also novelty/diversity (for model expressivity) and attack success rates (for security). When probing interaction awareness, include deterministic and sampled decoding to reveal latent capabilities (Shekkizhar et al., 2 Apr 2026).
• Recognize limitations in multilingual, multi-user, or extended history scenarios; test rigorously in targeted evaluation settings.
• Deploy layered strategies in production: client-side filtering, server context authentication, rate limits, and summary-based recall only as augmented by robust protocol control (Duan et al., 7 Jul 2025).

User-turn-only prompting thus represents both a critical access control primitive for secure, trustworthy conversational AI and a highly effective mechanism for dialog quality and controllability across model architectures and application domains.