AI research and discussion on LessWrong. www.lesswrong.com
A consumer-GPU replication of the role-confusion account of prompt injection finds steering and patching inconclusive, so whether the probed role axis is causal or a bystander stays unresolved.
Proposes that prompt injections exploit LLM role confusion, using role probes to show writing style overrides chat-template tags; introduces CoT Forgery, a jailbreak whose success tracks internal role perception.
Layer-wise analysis of Llama-3.1-70B finds jailbreak prompts show mid-layer harm signal that drops before output, unlike standard harmful prompts; the author notes structural confounds and calls for causal tests.