Large language models (LLMs) treat all input text the same, so attackers can hide commands inside data and trick the model into executing them, a security flaw called .
The researchers developed LLMON, a tagging system that marks each piece of text as an instruction or data. They created a large training set of such tagged examples, including confusing versions with competing instructions, and fine-tuned two small LLMs on it.
After post-training, attack success rates on injection tests dropped from most attacks succeeding to hardly any. The models kept their normal abilities. This shows that explicit instruction control can be taught without architectural changes, making LLMs more secure.