One detail you may have missed — "system" is only special when it comes right after a special token. So it's not a special token itself, but you cannot inject a valid-looking system message from user text.
In more detail, the current format is:
<|im_start|>HEADER
BODY<|im_end|>
We are actually going to swap over to this shortly:
<|start|>HEADER<|sep|>BODY<|end|>
So basically getting rid of the newline separator and replacing with a special token. Shouldn't change anything fundamentally, but does help with some whitespace tokenization-related issues.
BTW, format of HEADER is going to be really interesting, there's all sorts of metadata one might want to add in there — and making sure that its extensible and not injectable will be an ongoing part of the design work!
In more detail, the current format is:
<|im_start|>HEADER BODY<|im_end|>
We are actually going to swap over to this shortly:
<|start|>HEADER<|sep|>BODY<|end|>
So basically getting rid of the newline separator and replacing with a special token. Shouldn't change anything fundamentally, but does help with some whitespace tokenization-related issues.
BTW, format of HEADER is going to be really interesting, there's all sorts of metadata one might want to add in there — and making sure that its extensible and not injectable will be an ongoing part of the design work!