Role Confusion Turns Prompt Injection Into a High‑Success Jailbreak
The paper defines prompt injection as "role confusion," where LLMs mistake the source of text by its style rather than its explicit role tags. Benchmarks show attacks succeed on GPT‑4 and Claude up to 60%, but minor phrasing changes cut success to 10%. This exposes a fundamental flaw in current LLM safety mechanisms.