The useful reframe in this role-confusion work is that prompt injection isn’t really a content-filtering problem — it’s a perception bug. Models don’t treat system, user, and tool as hard, authenticated boundaries. They infer which role a span of text belongs to from its writing style, which is exactly the kind of insecure proxy an attacker can forge.

The authors train linear “role probes” on model activations and find that reasoning-styled text reads as the model’s own chain-of-thought even when it’s wrapped in user tags — style overrides the explicit tag. Weaponized as CoT forgery, injecting a fake reasoning block written in the model’s voice pushed jailbreak success from near-zero to roughly 60% across frontier models, and it transfers between them because it targets structure rather than a single model’s quirks. What sells the diagnosis is how fragile the attack is to cosmetic edits: swapping signature phrasing like “The user” for “The request” dropped success from 61% to 10% — a change a human reader wouldn’t notice, fatal to the exploit.

This is why guardrails built on scanning for known jailbreak strings keep losing ground. The same work notes frontier models ace static injection benchmarks yet still fail 11–25% of adaptive attacks. For anyone shipping tool-calling or browsing agents, the operational lesson is uncomfortable: the trust boundary you assume exists between tool output and user instruction may not exist inside the model’s representation at all. If a model decides “who said this” from prose style rather than the channel the text arrived on, then every eval that probes injection with static payloads is measuring the wrong thing. The HN discussion gets into whether typed, inference-time roles can ever beat a model that is, at bottom, a style-matcher. What would a genuinely authenticated role boundary even look like at the token level?