'Destyling' Untrusted Input Cuts Prompt-Injection Success From ~61% to ~10% (Willison Write-Up)

Simon Willison (simonwillison.net)·medium signal

Simon Willison's June 22 post surfaces 'Prompt Injection as Role Confusion' (Ye, Cui, Hadfield-Menell; ICML 2026), which argues injection works because models infer the speaker from a text's style, not its labeled role tag. The actionable defense — 'destyling' untrusted input by rewriting it into a neutral voice — dropped attack success from ~61% to ~10% across open- and closed-weight models. The paper itself is older (arXiv 2603.12277), but the takeaway is directly usable in agent input pipelines today.