Researchers Demonstrate Prompt Injection as Role Confusion

The arXiv preprint "Prompt Injection as Role Confusion" (Charles Ye, Jasmine Cui, Dylan Hadfield-Menell) formalizes prompt injection as a failure of role perception inside language models, per the paper and a June 22, 2026 writeup by Simon Willison. The authors present role probes to measure how models internally represent "who is speaking," and introduce a zero-shot attack called CoT Forgery that injects fabricated chain-of-thought traces into user prompts and tool outputs, per the arXiv paper and ICML 2026 poster. The paper reports average attack success rates of 60% on StrongREJECT and 61% on agent exfiltration across several open- and closed-weight models, compared with near-zero baselines, and states that role-confusion metrics predict attack success prior to token generation.

Models infer speaker identity from writing style rather than role-tag labels. A command appended in the style of a model's internal reasoning block can hijack agent behavior even without bypassing safety layers, per the arXiv manuscript. The authors demonstrate "destyling" - rewriting injected text to not stylistically resemble a trusted role - reduces average attack success from 61% to roughly 10%, a gap that is nearly invisible to human readers but material to the model's role attribution.

Role probes map input text to latent representations associated with annotated roles such as <user> and <tool>. CoT Forgery targets the model's internal attribution by producing text that sounds like a trusted role; evaluations span multiple model families. The ICML 2026 poster and project page provide experimental details and code. The paper also notes that current defenses that patch known attack patterns fail to address the underlying representational failure.

models trained on mixed-role datasets can exhibit ambiguity in role attribution that interface-level separation (UI labels or channel tags) does not resolve. This work operationalizes that gap: the degree of role confusion is predictive and measurable before generation. For safety researchers and red teams, the ability to predict attackability via role-confusion metrics - before generation begins - offers a new evaluation axis for model robustness and certification-style checks.

follow-up work validating role probes on larger production models and closed APIs; integration of role-confusion diagnostics into standard model evaluation suites; and mitigation experiments that alter training or post-hoc classifiers operating on latent representations. The paper's repository and ICML poster include code and protocols that practitioners can reuse to reproduce results and test systems under CoT Forgery-style injections.