Can LLMs separate instructions from data? And what do we even mean by that?
E. Zverev, S. Abdelnabi, S. Tabesh, M. Fritz, C. Lampert, ArXiv (2024).