2026-10-10 补充校核：角色混淆是注入路径之一，不能解释全部攻击；角色标签不建立可信边界，还需要按来源隔离、限制权限和验证动作。原文关于所有主流模型内部推理的概括未逐一验证。

A Theory of Why Prompt Injection Works — Role Confusion

What

Paper/blog by Charles Ye, Jasmine Cui, and Dylan Hadfield-Menell showing prompt injection is fundamentally a role-confusion problem. LLMs cannot distinguish between user messages, tool outputs, and system prompts in the token soup — role tags are fragile formatting tricks, not security boundaries.

Key Findings

• LLMs receive everything as one continuous token stream — no inherent distinction between channels
• Role tags (, , <tool_output>, ) are the only structure, but spoofable
• Authors trained linear probes measuring “CoTness” and “Data-ness” — LLM’s internal role perception
• Two defense modes: attack memorization (brittle) vs role perception (robust)
• Human red-teamers achieve near-100% ASR against frontier models

Why It Matters

Provides theoretical grounding for why external security layers (tirith, pre-exec-guard, tool-guard) are essential — LLMs cannot reliably enforce their own role boundaries.