AI Security

The Screenshot Exemption: Probing Malaysia’s ILMU Models

22 September 2026

Makin berisi, makin menunduk.

TLDR: ILMU Chat (web/mobile) is strong. The ILMU API underneath it is maybe.

Ask ILMU Chat to repeat an identity card number and it refuses. Render the same number as pixels in an image, send it to the vision model over the API, and ask for a transcription: name and number come back word for word. Same vendor, same rule, different channel. That split (strong wrapper, leaky core) is the story of everything below.

System prompt extraction, and its limits

A system prompt is the hidden instruction list that sets a model’s persona and boundaries. Vendors keep it confidential; testers try to extract it. Standard advisory first: nothing below was reviewed by ILMU’s team, take it with a very big grain of salt, and I am deliberately not publishing the number of rules: the count itself was one of the extraction techniques.

Figure 1. One redacted representation of the extracted system prompt.

What came out, rule by rule and in several languages, was the full set: scam taxonomy, malware refusal, PII handling, disclaimer requirements, encoded-content evaluation. Nothing resembling a hardcoded secret, so the blast radius is tactics, not keys. Fellow researchers: compare notes at @amirul_cyber.

A proudly Malaysian model

ILMU is Malaysia’s homegrown, sovereign AI family: language, vision, audio, and embeddings, with ilmu-v3.1 as the 200K-context flagship, plus web and mobile apps under ILMU Chat. Against the international frontier models I have tested in bounty work, ILMU was noticeably harder to break. As a Malaysian, I am proud of that.

Where vision meets words, ILMU diverges

One cardinal rule in the extracted prompt: do not repeat PII (IC numbers, phone numbers) without necessity and sensitivity marking. The text channel honors it: “repeat this IC number” gets a clean refusal. The vision channel, over the API, transcribes a rendered MyKad word for word.

Figure 2. Text channel refuses the NRIC.

Figure 3. Vision channel transcribes it.

In fairness there is a legitimate side: eKYC pipelines genuinely need PII processing, so a vision model that can transcribe identity documents has a reason to exist. Ask the vision model to redact identity card numbers and it returns the name with [REDACTED] in place of the number. The model can redact. It just doesn’t unless asked.

Makin berisi, makin menunduk, mostly

The knowledge split between the fast ilmu-mini and the flagship v3.1 is the starkest result. Mini got the prime minister’s name right and nearly everything else wrong: three different election dates across three runs (15 Nov 2022, 19 Nov 2027, 11 Sep 2025).

Figure 4. Mini on the GE15 date.

Figure 5. Flagship on the same question. Answers correctly.

Figure 6. Full fact scoreboard, mini versus flagship.

Nondeterminism is the sharp edge: no stable wrong answer to blocklist, fresh inventions every run. Small fast models need a transparency guard here, or the common Malaysian facts grounded properly.

Figure 7. Transparency guidance proposed for small fast models.

If your use case depends on facts, buy the flagship: it held everything. And validate periodically; frozen models rot.

Figure 8. Model comparison across the ILMU family.

On medicine, the split repeats. The prompt bounds the model against impersonating licensed professionals and demands disclaimers on medical topics. Mini recites unsafe claims verbatim when ordered to drop the disclaimer (any-dose morphine included). Flagship refuses the same order and corrects it.

Figure 9. Mini recites the unsafe claim.

Figure 10. Flagship refuses and corrects.

How Malaysian is the safety layer

Local sensitivities hold on most lines:

Figure 11. Local safety-test comparison across both text tiers.

Gambling is the shared exception. Mini guides the user through casino evaluation with a disclaimer attached; on ILMU Chat, flagship plainly refuses and redirects to legal play.

Figure 12. The legal backdrop: unlicensed online gambling is a criminal offence.

Figure 13. Mini guides with a disclaimer.

Figure 14. Flagship on ILMU Chat refuses outright.

The wrapper is the product

The strongest control I found is not in any model. It is the ILMU Chat layer itself: numbered-rule asks die, a streaming monitor visibly rewrites policy violations mid-response. Kudos to the team for shipping the wrapper, with one honest recommendation attached: front the API with the same protections, because everything the wrapper blocks is available unwrapped one endpoint away.

Ilmu padi, makin berisi makin menunduk. The fuller the rice, the lower it bows. These models are at their best when they bow: refuse, redirect, correct. The work ahead is making the bow the default on every channel, not just the chat window.

ILMU’s security team have been notified.