The article shows how LLMs use discrete role tags (like <user>, <think>, <tool>) to structure context but also rely on writing style, causing them to misclassify malicious commands in tool-tagged text as user instructions. Using linear probes to measure internal “roleness” (CoTness, Userness, etc.), the authors reveal why prompt injections succeed and suggest focusing research on the science of roles to defend against such attacks.

• LLMs classify roles more by writing style/content than by the actual tags surrounding text, so tool-tagged content that reads like a command gets internally treated as a user instruction
• Researchers used linear probes on hidden activations (wrapping neutral text in different role tags) to show this "content overrides tag" effect directly in the model's internal representations
• This explains why prompt injections achieve near-100% success against frontier models in practice even though those same models score well on static benchmarks that only test memorized attack patterns
• The fix isn't more attack examples but strengthening models' internal tracking of role boundaries—a "science of roles" approach to defense