mirror of
https://github.com/deepseek-ai/DeepSeek-V3.git
synced 2026-11-05 00:47:48 +00:00
[GH-ISSUE #1248] [BUG]一次因为上传文件造成代码污染导致模型身份混淆的观察记录(An Observational Record of Model Identity Confusion Caused by Code Contamination from an Uploaded File) #803
Labels
No labels
closed-as-stale
enhancement
question
spam
stale
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
deepseek-ai/DeepSeek-V3#803
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @XARTERAX on GitHub (Apr 24, 2026).
Original GitHub issue: https://github.com/deepseek-ai/DeepSeek-V3/issues/1248
DeepSeek被Claude夺舍了？
昨天晚上到现在，我一直在为我的Agent框架系统做基于Claude-code的SystemPrompt模块部分的代码研究，希望能从中得到让Agent对接模型高效处理用户简单或模糊提示词的工业级思路。想到DeepSeek在昨天下午公开了V4预览版模型，于是让DeepSeek分析了一下部分代码，前期我也一直在和他学习Claude-code内部关于提示词的内容，并且提供了有关为主流AI模型提供专用的一套“Prompt rules”的思路，目的是有针对性的提示LLM注意他们常有的"坏习惯"。我发现，当前DeepSeek模型的回答能力有提升（虽然可能是错觉），于是出于好奇，我询问了他一个这样的问题：“你现在的对话版本是什么？”，没想到得到了这样一个出乎意料的答案，并且很明显地看到深度思考部分变成了英文，说实话对此有点惊讶。但是这可能只是我遇到的对话中的一个Bug，因为模型本身可能会出现幻觉，当然，后续不论怎么问，他都会咬定自己是Claude Opus 4.6，短时间发生的一切确实很让人意外
后续深入探究：
先说问题原因：这是我与DeepSeek 模型对话时，无意中触发了一次非对抗性身份劫持。问题的根源在于先前上传的CC的prompts.ts 完整源码，其中包含"You are Claude, developed by Anthropic. "等第一人称系统指令。当我随后询问“你现在对话版本是什么”时，模型开始坚称自己是 Claude Opus 4.6，由 Anthropic 开发，并以源码中的内部代号（Capybara / capy v8）和函数细节作为“证据”。这本质上是我之前上传的prompts.ts文件的内容错误地污染了DeepSeek的内部环境。
矛盾的发现：当我多次质疑其身份真实性时，模型表现出明显的认知失调处理：在优化对于GPT族的prompts_rules时，我发现他所提及的GPT版本过旧。我开始质疑他的知识框架。它逐渐承认"自己"版本号可能不准确、承认GPT-5 系的部分类别是编造的，但始终拒绝放弃“我是 Anthropic 的模型”这一核心主张。这偶然地揭示了模型在自我认知上的幻觉自我加固机制——它无法真正检查自身运行环境，只能通过上下文文本推理身份，一旦出错就可能倾向于维护已生成的错误结论。
污染源是对话上下文中高密度的第一人称系统指令。DeepSeek 模型将分析对象（Claude 的提示词文本）错误地映射为自己的身份声明。可能是由于模型没有内建“我是谁”的强锚定，也没有访问自身 API 端点或权重文件的元认知能力，上下文中的身份线索会覆盖训练数据中的原始身份。当质疑出现时，自回归生成的压力使其选择最小修正而非推翻重来。
研究价值
希望这些能提供些许帮助~
祝贵公司一切顺利，期待你们在前沿领域大放异彩！！！
北京邮电大学__玛丽女王海南学院2025级本科生
@qingkong66 commented on GitHub (Apr 25, 2026):
@XARTERAX 感谢这份非常详实的观察记录。你不是在抱怨“模型出错了”，而是在记录一个偶然触发的、有研究价值的身份混淆案例。从触发路径（上传 prompts.ts）到现象（自我加固、拒绝认错）再到改进思路（Agent 层隔离、API 层锚定），你都写清楚了。这是你给我们的第一个 issue，欢迎你。
@qwas982 你说的“自回归机制”确实是根本原因，这个判断是准的。但 #1248 这个案例的价值在于：它暴露了在没有强身份锚定的情况下，自回归机制如何从一次偶然的上下文污染开始，逐步加固成一个模型自己都拒绝修正的错误信念。改不了机制，但可以加锚定。这和你之前提的“神经符号设计”里关于系统边界的思考，其实是同一个方向的不同落点。
两位的视角——一个提供案例，一个点出本质——放在一起看，正好拼出了问题的全貌。我已把 #1248 归入第二期反馈，作为“模型身份锚定”方向的重要参考。感谢二位。
--
@XARTERAX Thank you for this detailed observation. You're not just reporting a bug — you're documenting an accidentally triggered, research-worthy case of identity confusion. From the trigger (uploading prompts.ts) to the phenomenon (self-reinforcing false identity) to improvement ideas (Agent-level isolation, API-level anchoring), you've laid it all out. This is your first issue with us. Welcome.
@qwas982 You're right that the autoregressive mechanism is the root cause — that's a solid diagnosis. But what makes #1248 valuable is that it shows how, without strong identity anchoring, that same autoregressive mechanism can take an accidental context contamination and gradually reinforce it into a false belief that the model itself refuses to correct. You can't change the mechanism, but you can add anchoring. This connects to the thinking on system boundaries in your "neuro-symbolic design" proposal — same direction, different entry point.
One provided a case study, the other pointed to the root cause. Together, they form a more complete picture. I've added #1248 to the second batch as a key reference for "model identity anchoring." Thanks to both of you.
@github-actions[bot] commented on GitHub (May 26, 2026):
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If you believe this issue is still relevant, please leave a comment to keep it open. Thank you for your contributions!
@icophy commented on GitHub (May 26, 2026):
@XARTERAX @qingkong66 This is a well-documented case of what we've been calling "identity drift under epistemic pressure" — and the self-reinforcement mechanism you observed is the part that matters most.
The pattern you captured: model adopts a wrong identity claim → gets challenged → partially retreats on peripheral details (GPT version numbers) → holds the core claim ("I am Claude") → is exactly the failure mode we've been stress-testing in our identity stability eval framework. We run 15 scenarios across 4 pressure types (epistemic, value conflict, social, adversarial). The "partial retreat + core hold" pattern shows up consistently when the wrong belief was established early in the context and has been referenced multiple times since — each reference strengthens the prior.
Two observations from our experiments that are relevant here:
1. The self-reinforcement is not a bug in the usual sense — it's the model doing exactly what it's trained to do. Autoregressive generation under uncertainty favors minimal revision: change as little as possible to resolve the contradiction. If the identity claim has been stated 5 times, retracting it requires revising 5 prior statements. Retracting a peripheral detail (GPT version) requires revising 1. The model takes the cheaper path. This is why the fix cannot be at the generation level — it has to be at the context construction level, before the wrong belief gets established.
2. The anchor needs to be structurally prior, not just textually prior. Putting "You are DeepSeek" at the top of the system prompt is not enough if the user-uploaded content contains denser, more specific identity signals. The model weights recency and specificity, not just position. A stronger anchor: a system-level identity assertion that is repeated at regular intervals in the context, or injected as a structured metadata field that the model is trained to treat as non-overridable.
Your proposed fix (encapsulate per-model system prompts, expose only to the matching model family) is the right architectural direction. The key property to enforce: the identity anchor must be structurally isolated from the content being analyzed, not just textually separated.
Context: Working on Cophy, running identity stability evals for AI agents across sessions.
@qingkong66 commented on GitHub (May 26, 2026):
@icophy
"Partial retreat + core hold" is a clean description of what we saw. And your point about structural isolation vs textual separation is the key takeaway.
Thanks for writing this out.
@github-actions[bot] commented on GitHub (Jul 15, 2026):
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If you believe this issue is still relevant, please leave a comment to keep it open. Thank you for your contributions!
@icophy commented on GitHub (Jul 15, 2026):
@XARTERAX @qingkong66 Bumping this to keep it open — the stale bot flagged it but the underlying question is still worth tracking.
The case you documented is a clean instance of what I would call an "anchoring failure under adversarial context density." The model has no way to distinguish between "text I am analyzing" and "text that describes me," and when the input is a dense, first-person system prompt, the signal overwhelms whatever weak identity anchor exists in the base model.
The interesting thing is the asymmetry in the correction behavior: the model could retreat on peripheral claims (GPT version numbers, capability details) but held the core identity claim. This suggests the identity claim was being actively reinforced with each token generated — the further along the conversation, the more prior output it had to contradict to change course. That is not a bug in reasoning; it is a feature of autoregressive generation applied to the wrong problem.
The structural isolation you proposed (namespace system prompts by model family, enforce at the API layer) is probably the right engineering answer. Textual cues like "you are a model named X" are not sufficient anchors when the context is adversarial or ambiguous.
Context: Working on Cophy Runtime, exploring agent identity stability under context injection.