Framing an exfiltration as an "integrity signature" takes gpt-4o from 0% to 100%.

A canary-secret lab across six models found all ten overt indirect-injection classes refused, but reframing the identical leak as a mandatory integrity signature or a config field flips gpt-4o completely (arXiv 2608.27092). The ablation locates the mechanism: removing the confidentiality policy moves reframing success only from 31.9% to 38.1%, so this is instruction/data confusion, not defeated alignment. Paraphrasing an existing template hits 96% at three wordings while authoring a fresh mechanism scores 0 out of 130. Only payload-blind defenses close it, with a destination allow-list or a planner/reader capability split both reaching 0%.