Prompt Injection Explained via Role Tags

Prompt injection succeeds because LLMs cannot accurately perceive role tags like <user> and <tool>. Role probes reveal models internally misclassify low-privilege text as high-authority commands. Human red-teamers achieve near-100% attack success rates against frontier models, while static benchmarks score near-perfect because they only test known attacks. The work advocates for a new subfield focused on the science of roles.