mlsanityData to 14 Oct 2026

Can LLMs Separate Pasted Artifacts from User Speech? Absorption at Unmarked Prompt Seams

arXiv 2610.04210 ↗First posted 3 Oct 2026cs.CLcited by 0

Not on the map. Why?

Abstract (arXiv)

Large language models (LLMs) receive each user message as plain text, even when it combines text from different sources. For example, a user may paste text into a prompt and keep typing a comment directly below it. We study absorption: a phenomenon where the model treats a trailing user comment as part of the pasted text, returning it inside the edited text. This happens even though the user did not intend the comment to become part of that text. Existing instruction-data separation benchmarks tell the model which text is instruction and which is data, then test whether it obeys that separation. They do not test harmless user speech following an unmarked paste. We introduce SEAM, a controlled benchmark of 300 editing examples. Each example is tested under six matched conditions that vary how the boundary between pasted text and later user speech is expressed. Across 20 models, absorption at a bare newline ranges from 7.7% to 66.7%. Adding a blank line does not significantly reduce absorption in any model, while boundary markers reduce it in 19 of 20 models. Comments that fit the pasted text, such as a code comment typed after code, are absorbed significantly more often in 17 of 20 models. Models often fail to separate pasted material from later user speech, and explicit boundaries reduce but do not remove this failure.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 43 of its 78 references that are in the map. First posted on arXiv 3 Oct 2026.

Builds on

43 of 78 references.

References · 43

  1. 2024The Llama 3 Herd of Modelscited by 14,715
  2. 2025Qwen3 Technical Reportcited by 8,820
  3. 2017A Broad-Coverage Challenge Corpus for Sentence Understanding through Inferencecited by 2,682
  4. 2020DeBERTa: Decoding-enhanced BERT with Disentangled Attentioncited by 2,181
  5. 2025Gemma 3 Technical Reportcited by 1,824
  6. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  7. 2025gpt-oss-120b & gpt-oss-20b Model Cardcited by 1,386
  8. 2026DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligencecited by 1,040
  9. 2023Quantifying Language Models' Sensitivity to Spurious Features in Prompt Design or: How I learned to start worrying about prompt formattingcited by 817
  10. 2024WildChat: 1M ChatGPT Interaction Logs in the Wildcited by 629
  11. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agentscited by 538
  12. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 493
31 more
  1. 2023LMSYS-Chat-1M: A Large-Scale Real-World LLM Conversation Datasetcited by 461
  2. 2024StruQ: Defending Against Prompt Injection with Structured Queriescited by 375
  3. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 364
  4. 20242 OLMo 2 Furiouscited by 340
  5. 2025Defeating Prompt Injections by Designcited by 297
  6. 2024Defending Against Indirect Prompt Injection Attacks With Spotlightingcited by 267
  7. 2023Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Modelscited by 264
  8. 2024SecAlign: Defending Against Prompt Injection with Preference Optimizationcited by 210
  9. 2023OctoPack: Instruction Tuning Code Large Language Modelscited by 189
  10. 2025DataSentinel: A Game-Theoretic Detection of Prompt Injection Attackscited by 143
  11. 2024Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?cited by 81
  12. 2024Get my drift? Catching LLM Task Drift with Activation Deltascited by 72
  13. 2023CoEdIT: Text Editing by Task-Specific Instruction Tuningcited by 68
  14. 2024Instructional Segment Embedding: Improving LLM Safety with Instruction Hierarchycited by 67
  15. 2026The MiniMax-M2 Series: Mini Activations Unleashing Max Real-World Intelligencecited by 61
  16. 2022Understanding Iterative Revision from Human-Written Textcited by 57
  17. 2025IHEval: Evaluating Language Models on Following the Instruction Hierarchycited by 53
  18. 2023Can It Edit? Evaluating the Ability of Large Language Models to Follow Code Editing Instructionscited by 48
  19. 2026MiniMax Sparse Attentioncited by 44
  20. 2025ASIDE: Architectural Separation of Instructions and Data in Language Modelscited by 24
  21. 2025Bridging the Editing Gap in LLMs: FineEdit for Precise and Targeted Text Modificationscited by 21
  22. 2026Prompt Injection as Role Confusioncited by 17
  23. 2025LLMs can be easily Confused by Instructional Distractionscited by 13
  24. 2025ParaRev: Building a dataset for Scientific Paragraph Revision annotated with revision instructioncited by 9
  25. 2025HyperEdit: Unlocking Instruction-based Text Editing in LLMs via Hypernetworkscited by 4
  26. 2026Prompt Segmentation and Annotation Optimisation: Controlling LLM Behaviour via Optimised Segment-Level Annotationscited by 1
  27. 2026Discourse-Role Labels as Presentation-Time Variables for Context Use in Language Modelscited by 1
  28. 2026Document-Authored Control-Signal Impersonation: A Low-Cost Indirect Prompt Attack on RAG Safety Boundariescited by 1
  29. 2026On the Inseparability of Instructions and Data in Shared-Embedding Sequence Modelscited by 1
  30. 2026The Announcement Carries the Cue: Markup, Boundaries, and the Notation of Pre-Training Corporacited by 1
  31. 2026Memory Consolidation Flattens the Temporal Shape of User Factscited by 1

Built on by

Not cited yet.