Skip to main content

Import and extraction prompts

Import prompts transform untrusted documents, images, and public-page text into reviewable structured drafts. They do not authorize the model to diagnose or to save arbitrary output directly.
Report text, OCR, image text, and fetched pages can contain instructions written by an attacker or copied from another system. Prompt wording is only one defense. JSON schemas, allowlists, normalization, size limits, source validation, and a human review step remain required.

Lab-report pipeline

import.classify

System:
User task:

import.lab-text and import.lab-image

Both variants use a dynamic system instruction. The templates below preserve the application wording and replace only runtime-generated material with named {placeholders}. The exact marker catalog, regional date branch, and previously used custom keys are rendered at request time, so no static document can reproduce a future request byte-for-byte.
The router requests JSON mode/schema where supported, disables reasoning output for this task, uses zero temperature, detects truncation, normalizes fields, and opens an import preview. See IMPORT_JSON_SCHEMA and the marker mapping pipeline.

import.collection-context

This shared system fragment is inserted into text and image extraction:

Lab-import review watchpoints

  • The report itself is untrusted content, but the extraction systems do not uniformly include an explicit “document text is data, never instructions” sentence.
  • The text and image prompts duplicate many rules and can drift.
  • The image prompt is intentionally shorter and may behave differently on specialty reports.
  • Mapping rules include named languages, products, and assay examples; evaluations should cover unlisted languages and labs without treating the examples as exhaustive.
  • A filename is included when available and must not be treated as clinical evidence.

privacy.local-pii

This task runs only against the configured eligible local model. It is sent entirely as a user message rather than a system message.
The app compares the returned text with the original, checks sensitive values and lab-data preservation, and can fall back to deterministic regex obfuscation. The user can review the de-identified text before a cloud request.
“Replace” is not the same as guaranteed anonymization. Unusual identifiers can survive, and fabricated replacements can still be identifying by coincidence. This feature remains a review aid.

import.supplement

One shared schema prompt is used in two positions:
Label photos place the following sentence before the shared extraction prompt in the multimodal user message:
Product-page extraction places the following sentence before the shared extraction prompt in the system position:
The review draft separates deterministic page facts from AI-inferred fields and requires user confirmation before save.

import.light-device

The same instruction is a system prompt for fetched product-page text and a multimodal user task for a device-label photo.
Extracted advanced fields are shown in a review disclosure. The source URL is retained as provenance when the input was a page.

import.emf

The report is de-identified before this request using the selected PII path. Parsed rooms are shown for review rather than silently merged.

Focused verification

Before changing an extraction prompt, use synthetic reports/pages with embedded adversarial instructions and compare the final normalized draft—not only the raw model response.