The article shows how LLMs use discrete role tags (like <user>, <think>, <tool>) to structure context but also rely on writing style, causing them to misclassify malicious commands in tool-tagged text as user instructions. Using linear probes to measure internal “roleness” (CoTness, Userness, etc.), the authors reveal why prompt injections succeed and suggest focusing research on the science of roles to defend against such attacks.