Typed instruction/data model training reduced tested injection but left other failure classes

LLMON introduces a typed distinction between instruction-like messages and data-like content during model post-training. On selected indirect prompt-injection benchmarks, the authors report reductions from nearly complete attack success to low single-digit percentages or less, depending on the model and test. Those changes measure behavior in the tested setting, not a hard access-control boundary. The paper also reports weaker protection against other direct and multi-turn attack conditions.

The distinction matters for tool-using agents because a safer internal representation reduces confusion but does not change the API token or shell permissions held by the surrounding program. The full test for a defense must include normal task utility, adaptive attack variants, and final unauthorized tool effects. A classifier or trained refusal alone cannot prove the absence of credential access or persistent state changes.