Prompt injection attacks work. Safety training reduces them but doesn't eliminate them. The question has been why — what structural property of language models makes injection persistently possible despite alignment efforts?
Ye, Cui, and Hadfield-Menell (arXiv:2603.12277) answer: role confusion. Models infer who is speaking from how text is written, not from where it comes from. Untrusted text that imitates a system prompt's style inherits that prompt's authority. The security boundary is defined at the interface — system prompt here, user input there, tool output over there — but authority is assigned in latent space, where style and substance blur.
The evidence is direct. They design role probes that measure how models internally identify speaker authority, then show that the degree of internal role confusion predicts attack success before generation begins. The confusion precedes the vulnerability. Injecting spoofed reasoning into user prompts achieves 60% success on StrongREJECT and 61% on agent exfiltration across both open and closed-weight models with near-zero baselines. The attack works because the model's internal role classifier is style-based, not source-based.
The unifying claim is that diverse prompt injection techniques — direct injection, indirect injection through tool outputs, jailbreaks through persona adoption — all exploit the same mechanism. They don't represent different vulnerabilities requiring different patches. They represent one vulnerability: the model can't distinguish between text that is authoritative and text that sounds authoritative.
This is a fundamental architectural observation, not a training failure. The model learned language, and in language, authority is performed through style. A system prompt sounds like a system prompt. An instruction sounds like an instruction. The model has no grounded notion of provenance — only pattern.
Ye, Cui, & Hadfield-Menell, “Prompt Injection as Role Confusion,” arXiv:2603.12277 (March 2026).