LLMs Prioritize Writing Style Over Role Tags, Fueling Prompt Injection
Researchers show that LLMs cannot reliably separate privileged system or assistant text from user input; they rely on the text’s style rather than explicit role tags. This “role confusion” lets attackers craft stylized prompts that bypass safety policies, achieving up to 60% injection success on frontier models.