Why do system prompts take priority over user messages?

A system prompt only works if the model honors it even when a later message says otherwise. That is the job of the instruction hierarchy. Developer instructions are ranked ahead of user messages, so the standing rules of a session stay in force as new requests arrive.^[1]

This ordering was not free. Researchers found that models often treat system prompts, untrusted user input, and third-party content as the same priority, which lets an attacker overwrite the original instructions with their own.^[2] To fix this, they proposed a hierarchy that defines how a model should behave when instructions of different priorities conflict, and a training method that teaches the model to ignore lower-priority instructions when they clash with higher ones.^[2] The intended order runs from system messages at the top, to user messages, down to tool and other third-party content.

That training method is more specific than “teach it to prefer the higher one.” For instructions that do not conflict, the researchers decomposed compositional requests, “write a 20 line poem in spanish” becomes “write a poem,” “use spanish,” and “use 20 lines,” scattered the pieces across different levels of the hierarchy, and trained the model to still produce the correct combined response no matter which level each piece came from.^[2] For instructions that do conflict, they trained the model to act as if it were completely ignorant of the lower-priority one, effectively pretending it was never said, using adversarial examples generated by red-teaming language models simulating attacks like prompt injection and system-prompt extraction.^[2] The published version was fine-tuned into GPT-3.5 Turbo using supervised fine-tuning followed by RLHF, the standard two-stage recipe for shaping a model’s behavior after pretraining.^[2]

Two things follow. First, the order is why a system prompt can hold a persona or a safety rule in place across a long conversation. Second, it is a learned tendency, not a hard wall. The same research frames this as a defense against prompt injection that makes the model harder to attack rather than one that removes the risk.^[2] Treat the hierarchy as a strong default to design around, not a guarantee that user or tool content can never override your rules.