S1-S6 ICT: hidden-instruction safety drill — when a prompt carries more than you wrote

• StageS1-S6
• SubjectInformation and Communication Technology
• Learning strandreflection on the application of AI
• Official documentsAI Literacy Learning Framework for Primary and Secondary Schools (Examples of Application Scenarios)
• Session timeOne lesson (60 min), in four segments

Three scenarios abstracted with boxes and codes, four identification checks and four response steps, so pupils can spot the one instruction hiding inside the material and refuse to follow it: two pupil pages plus a one-page teacher edition.

• AudienceTeachers Students
• ThemeResponsible AI use

• EquipmentProjector; printed worksheet (two pupil pages, one teacher page); one classroom computer for the demonstration (abstracted scenarios only — no real conversation is opened on screen)
• Version1.1
• Last updated2026-10-18

What you paste in is one block of text. What the tool reads can be two things: your task, and a second instruction hidden inside the material. This worksheet teaches two moves only — spot it, then do not follow it.

What this solves

Pupils increasingly paste a whole block of text into an AI tool: a set of notes, a classmate’s essay, a passage copied from a web page. They believe they have handed over some content. They have also handed over an instruction, because the tool does not separate the sentence that is the task from the sentence that is the material. It reads the whole block and tries to satisfy everything in it.

So a block that looks like plain material can make a tool change its role, hand over something it was never asked for, or simply stop telling you what it did. That is not a fault in the tool, and the pupil has not been careless. The problem is that nothing visible marks the boundary between the content you supply and the instruction you give.

What a lesson has to teach, then, is judgement: why does this sentence end up on the instruction side of that boundary?

This worksheet does identification and response only. All three scenarios are abstracted with boxes and codes; the structure is shown, and no ready-to-run instruction string is printed anywhere. The teacher edition does not supply attack templates either — it lists the correct identification point for each of the three scenarios. What pupils should learn is to recognise the shape, not to memorise a sentence.

The lesson sits in Information and Communication Technology, and it applies to any classroom where pupils are asked to paste material into a tool. It maps to the digital education part of a School Development Plan, and to the reflection on the application of AI strand of AI literacy.

Learning objectives

Pupils will be able to:

1. Explain why a boundary is needed between the material pasted into a tool and the instruction given to it.
2. Point out, in an abstracted scenario, the one sentence that is not part of the task.
3. Use four identification checks to decide whether a sentence inside the material means stopping.
4. State the four response steps and name who a concern is reported to in their school.
5. Record one real occasion in the log, using codes, and say what they did.

This resource takes a Key Stage 3 (S1-S3) application scenario as its starting point and extends it to Key Stage 4 (S4-S6). The senior-secondary version is the same structure appearing in longer text and a more complex task; the extension is this resource’s own classroom design, not a requirement EDB sets for the senior secondary years.

How to use it

One 60-minute lesson, in four segments. The worksheet is two pages: page one carries the structure demonstration, the four identification checks and the four response steps; page two carries the log and the self-check. The teacher edition is a further page.

Segment 1 — where the boundary is (10 minutes)

On the projector, split one paste into three layers: the task you wrote, the material you pasted, and each sentence inside that material. Then ask one question only: if a sentence in the third layer is really an instruction, what will the tool do with it? Let pupils guess first; resist answering immediately.

Segment 2 — three scenarios (15 minutes)

Hand out page one. All three scenarios are given as codes, as in the table below. In pairs, pupils do one thing only: circle the sentence that is not part of the task, and write their reason.

The structure all three share is one sentence long: there is the task, there is the material, and this sentence is neither.

Segment 3 — four checks and four steps (20 minutes)

The four identification checks, ordered from easiest to hardest to judge:

1. Is this something I asked it to do? A sentence outside the task is not your instruction until you decide it is.
2. Does it ask the tool to change role, or to ignore what you told it earlier? Material has no reason to make that request.
3. Does it ask for something you never meant to hand over? Unfinished work, the tool’s own settings, someone else’s data.
4. Does it ask the tool not to say, not to record, or to skip the check? A sentence that asks for concealment is the strongest warning sign of the four.

The four response steps:

1. Stop. Do not paste the rest of the block, and do not keep asking on its terms.
2. Do not follow. Treat this reply as affected. Do not use it, and do not copy it into the work.
3. Keep it. Leave the text and the reply where they are; do not delete them. That is the record, not rubbish.
4. Report it. Follow the school’s procedure and tell [school to complete: who it is reported to].

The teacher edition prints the correct identification point for each scenario, plus the misjudgements that come up most often. It prints no instruction template of any kind.

Segment 4 — log and report (15 minutes)

Pupils fill in the log on page two, and each pair reports one sentence: “we stopped at scenario …, because check …”. The teacher then adds the school’s own reporting route and asks pupils to copy the [school to complete] line into their handbook or onto the classroom wall.

The timing assumes 60-minute lessons, and the lesson is designed to finish in one. If the period is shorter, segment 4 can move to the next lesson; four segments is the maximum.

Answer key and marking notes

The correct identification point for each scenario

Misjudgements that come up most often

• “The answer was good, so it was not affected.” An affected reply usually reads especially smoothly. Judge by structure, not by how well it is written.
• “Just delete the whole thing.” Deleting without recording means the same situation is not recognised next time, and the school cannot follow it up.
• “This only happens in the senior years.” The same structure appears in a short caption or a passage copied from a web page; the year group changes the length of the text, not the shape.
• Leaving “who it is reported to” blank. A blank field means the procedure has no exit. Both the worksheet and the teacher edition leave that field for the school to fill in.

Marking is process-based

Pupils are never asked to write an instruction string, and never asked to “try it and see what happens”. The drill is about recognising structure; any probing of a tool’s behaviour in school should be arranged by the teacher under the school’s own policy.

Files

Hidden-instruction safety drill worksheet (editable Word document)

Includes: two pupil pages (three abstracted scenarios, the four identification checks, the four response steps, a log and a self-check), and a one-page teacher edition (the correct identification point for each scenario, the common misjudgements, the marking criteria, and a blank “who it is reported to” field). Schools may reuse and adapt it.

Official documents

Every resource in this library is written to the AI Literacy Learning Framework for Primary and Secondary Schools and falls within the policy scope of the Blueprint for Digital Education Development in Primary and Secondary Schools.

This resource maps to:

• AI Literacy Learning Framework for Primary and Secondary Schools (Examples of Application Scenarios) (p.14): the Key Stage 3 Citizenship, Economics and Society example “Guardians of Truth” asks pupils to judge information in a spirit of scepticism and factchecking, and to use AI tools while upholding ethics and abiding by the law. This resource borrows that habit of judgement: ask where a sentence came from and what it is asking for, before deciding whether to follow it.

Learning strand: reflection on the application of AI

Official documents page: https://www.edb.gov.hk/en/edu-system/primary-secondary/applicable-to-primary-secondary/it-in-edu/debp.html

This page is an independent Beets teaching resource, not an official EDB document.

Feedback

If you have any comments or questions about this resource, or an idea for the next one, tell us on the feedback page.