Where should untrusted input stop?
Compare an instruction embedded in model input with data entering a parser. Both examples ask who gets to decide what is treated as an instruction.
Read on through a shared source
Does running a model explain its decision? →Executing a model yields an answer. Explaining why that answer followed, or predicting its behavior under a new input, requires further evidence.When does a text predictor become an assistant? →Next-token prediction teaches continuation. Compare how later training shapes responses to a user; the distinction does not prescribe a single post-training algorithm.When does an expressive format become an attack surface? →A format can admit computation its designer did not anticipate. That changes what it means to process input supplied by someone else.
Compare the passages
prompt injection is about hijacking the large language model giving it what looks like new instructionsif you haven't recognized it don't goddamn process it