Type: url
Original: https://simonwillison.net/2026/Jun/22/prompt-injection-as-role-confusion/
Status: generated
Summary
A link post reporting on research that frames prompt injection as “role confusion”: the finding that models distinguish their own privileged text from untrusted user input largely by its style rather than by the role tags wrapping it. It relays the reported result that rewriting an injected passage so it reads less like the expected format — “destyling” — drops average attack success across the researchers’ dataset from 61% to 10%, and the researchers’ conclusion that injection defence will remain whack-a-mole until models achieve genuine role perception. The post also praises the practice of publishing a readable blog-style writeup alongside a formal paper.