"Destyling" untrusted input drops injection success from ~61% to ~10%.

Simon Willison's June 22 write-up surfaces "Prompt Injection as Role Confusion" (Ye, Cui, Hadfield-Menell, ICML 2026), which argues injection works because models infer the speaker from a text's style, not its labeled role. The defense: rewrite untrusted input into a neutral voice before the model sees it, which cut attack success from ~61% to ~10% across open and closed models. (Simon Willison) It's not a complete fix, and per the OWASP finding above nothing is, but it's a cheap layer you can add to an input pipeline this week.