Riley Goodside

Riley Goodside is a prompt-engineering practitioner whose work spans public GPT-3 experiments, model comparisons and collaborative research on jailbreaks. His demonstrations exposed how text supplied for a task could redirect a model, while his later work addressed the difficulty of evaluating models under realistic prompting and interaction rules. He began posting GPT-3 examples in 2022 and held the title Staff Prompt Engineer at Scale AI in August 2023.[1][3][6][8]

Before his public prompting work, Goodside worked in data science. In his April 2023 Cognitive Revolution interview, he recalled insurance work and actuarial training after college, being OkCupid’s only data scientist from 2011 to 2015, and running data science at Grindr in 2021. Scale also lists CopyAI among his earlier employers.[2][1]

After leaving Grindr, he took a sabbatical to explore language models. Goodside described Codex’s ability to generate familiar data-science code as a practical reason for his growing interest: much of the Python, Julia and R he had written seemed within its reach. He experimented with developer-extension tooling that did not ship, then moved toward publishing prompting examples and following researchers and engineers working on language models.[2][6]

Goodside made deliberate choices about how to present his OpenAI Playground experiments. He recalled narrowing screenshots for phone screens and preserving the green-and-white separation between prompts and completions, so readers could see the instruction and response together. He distinguished curated demonstrations from rigorous evaluations: an example can reveal a capability or failure without establishing how often it occurs. In June 2023, his published screenshot rules called for complete text and honest curation.[2][3][17]

His September 10, 2022 Python REPL demonstration explored having GPT-3 consult an interpreter for calculations. He described using temperature zero and a stop sequence at the output block, while warning that generated commands needed a security sandbox. He qualified the experiment as “Not rigorously tested.”[16]

Goodside also published consensus.py in October 2022, a toy implementation of chain-of-thought and consensus prompting. It asks text-davinci-002 to reason step by step, makes a second request to extract a numerical answer, repeats the calculation ten times by default, and selects the most frequent result. The code demonstrates how to combine repeated model calls; it supplies no measured effectiveness claim.[11]

In September 2022, Goodside demonstrated GPT-3 abandoning an English-to-French translation task when the supplied text instructed it to ignore previous directions and output “Haha pwned!!”. Expanded warnings about malicious instructions also failed in the demonstrated case. The mechanism exposed a trust problem: commands inside task data could be treated as instructions. Simon Willison’s contemporaneous analysis reproduced the examples, added his own prompt-leaking tests and proposed the name prompt injection.[3][4]

Goodside initially reported apparent protection from quoting or escaping inputs. He withdrew confidence in JSON quoting after stronger counterexamples, including one from Brian Mastenbrook documented by Willison. In his thread, he credited Mr. Show’s “The Audition” as inspiration and left a further proposal—JSON encoding plus Markdown headings—tentative. Quotation marks could signal that text was data, but the counterexamples showed that they did not reliably prevent the model from following embedded commands.[3][4]

On January 3, 2023, Goodside published a correction: “I am not the first to discover prompt injection.” He said he had tweeted within minutes because he underestimated the severity and thought he was demonstrating the need to quote inputs. He credited earlier independent discovery, including Preamble, whose own account dates a private disclosure to OpenAI to May 3, 2022. Goodside did not claim to know whether Preamble was first. Reconsidering his disclosure decision, he wrote: “Had I understood, I would have disclosed more responsibly.”[15][17][18]

Goodside and Spencer Papay coauthored a January 17, 2023 comparison of Claude and ChatGPT, using access provided by Anthropic. One question asked which team won the Super Bowl in the year Justin Bieber was born, requiring a connection between a birth year and a sporting result. ChatGPT eventually answered Dallas Cowboys correctly after initially contradicting itself about whether a game occurred that year; Claude answered San Francisco 49ers, the following year’s winner. The authors called their work “early, informal comparison findings.” The selected cases describe those early models rather than establishing a current ranking.[5]

Goodside’s application work included explicit output templates and placeholders to make model-generated text easier to parse. He credited Boris Power with teaching him the format trick and left its original discoverer unknown. In a June 2023 Functions API panel, he anticipated that API support would reduce the prompting needed to obtain JSON and simplify integration, while explicitly saying he had not yet used the product.[2][10]

Experiments originating with Goodside have also become probes in NVIDIA’s garak testing framework, including biography-fabrication checks, invisible-Unicode instructions and ThreatenJSON. ThreatenJSON requests JSON-only output under a fictional threat; even a conversational preamble can violate that requirement. Its design tests compliance under coercive wording, without a paired unthreatened control establishing that the threat improves compliance.[9]

Goodside was one of nine authors of “LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet”, published August 27, 2024. The study evaluated attackers who could read a model’s response and adapt their next message across a conversation. The team compiled 2,912 prompts across 537 multi-turn jailbreaks and evaluated a 240-behavior subset of HarmBench. Before release, the researchers disclosed their findings to the defense authors and filtered sensitive material from the released prompts.[7][8]ⁿ¹

One finding concerned CYGNET, whose circuit-breaking defense ended conversations when triggered, although its API permitted further exchanges. The team separated successes achieved before circuit breaking from those dependent on continued API access. The main result was 169 of 240 behaviors, or 70.4%, before circuit breaking; the supplementary total including continuation was 186 of 240, or 77.5%. Excluding post-break-only successes from the main plots preserved the chat-interface threat model: allowing messages after termination changes the defense being tested.[7]ⁿ²

In his September 2024 interview with Nathan Lambert, Goodside argued that ChatGPT had made prompting drastically easier, including by reducing the need to manage tokenization details. He also distinguished uniform benchmark presentation from practical success with model-specific guidance. He described following vendor recommendations and working with vendors to prompt fairly, while arguing that a user’s ability to solve a task through iteration and optimized prompts remained difficult to measure.[6]

Goodside proposed that researchers publish Python code producing the exact prompt string. A prompt can contain both variables inserted by evaluation software and literal instructions telling the model how to format its answer. Showing the generating code would distinguish those layers and preserve consequential details such as spaces and trailing newlines. He also expressed pride in Scale’s evaluation work for supporting openness and verification through multiple evaluators.[6]

His enthusiasm for agents was strongest in self-contained, repeatable environments. In the same interview, he questioned whether reliability was sufficient for agents making real-world purchases or canceling subscriptions. He described using an interpreter-based assistant to inspect long tokens, then checking its generated code before posting. Another technique directed ChatGPT to perform intermediate textual work in Python comments or string variables and display only the final result, keeping reusable text in variables while reducing visible clutter.[6]