“When you and I are talking, I can tell which words are coming out of my mouth because I can feel my mouth moving,” says Cui. But an LLM just sees a continuous stream of text; a user’s prompts are mixed up with the model’s previous responses, scratch-pad notes, text copied from documents, and so on. “It’s just one big sheet of tokens,” she says.

To help keep track of who said what, chatbots use tags to break the text up by what researchers call roles. Everything you type gets put between tags, and everything the LLM writes back gets put between tags. Text provided by a model’s designers to guide its core behavior is put between tags, text that a model generates in its chain of thought is put between tags, and text that a model picks up from an external source, such as a web page or another agent, gets put between tags. (Cui says that these are the labels OpenAI uses for its models; other firms might use different ones. The purpose is the same, however.)

Roles have become the foundation on which LLMs are trained to resist hacks, because most attacks boil down to tricking the model into acting as if an instruction came from someone or something it did not. For example, many jailbreaks (where a user tricks a model into saying or doing things its makers do not want it to) work by making a model read text as if it were or text. And many prompt injections (where a hacker slips a model new instructions) work by making a model read text as if it were , , or text.

When model makers train LLMs to resist attacks, a lot of it comes down to getting the models to spot when instructions pop up in places they shouldn’t.  

But what Cui and her colleagues discovered is that LLMs are in fact very bad at keeping track of different roles. In a series of experiments that looked at what was going on inside a handful of different models, the researchers found that LLMs seem to identify the role of a specific chunk of text not by the tags around it but by the style of that text and the words it contains.

They found that swapping tags around—replacing tags with tags, for example—made almost no difference to how the LLM interpreted the text itself. If it looked like text from its own chain of thought, then the LLM acted as if it really were. Ditto for all other roles.  

Weak link

The upshot, the researchers claim, is that all an attacker needs to do to hack an LLM is write text that spoofs a certain role. And because roles are a fundamental part of how LLMs work, no amount of training will fully solve the problem.

“I like this paper a lot,” says Florian Tramèr, a computer scientist who works on LLMs and cybersecurity at ETH Zürich. The attack insight is really neat, he says.