Imagine you're on a phone call with your bank. A third party on the line starts speaking in a calm, professional tone — and the bank's system routes their requests as if they were you, because they sound like the customer. That's role spoofing in LLMs: malicious text embedded in tool outputs (a scraped webpage, a retrieved document) that mimics the user's conversational role so convincingly that the model treats it as a genuine user instruction. This paper dissects why that happens and proposes the first detection-specific countermeasure. The committed claim: LLMs track 'who said what' using two channels — content cues (semantics, writing style) and structure cues (control tokens, formatting) — and attackers who combine both channels achieve dramatically higher spoofing success than either channel alone. The paper further claims that adversarial training against content-based injections leaves models structurally vulnerable, explaining why frontier models with improved injection resistance still fall to role spoofing. Finally, linear probes trained on internal activations can detect spoofed roles across settings. The architecture here is interpretability-first. The authors treat the LLM's internal representations as the object of study, using linear probes — simple classifiers trained on hidden-state activations — to predict which conversational role the model internally assigns to each token. This is mechanistic interpretability applied to a security problem, not a new model architecture. The probing technique leans on the linear representation hypothesis: that concepts like 'this token belongs to the user role' are encoded as directions in activation space that a linear classifier can recover. The ladder position is interesting. Ye et al. (2026) first documented role confusion; this paper advances from observation to mechanism to mitigation. Prior work on prompt injection defense has focused on training-time hardening — system prompts, RLHF, adversarial fine-tuning. The key finding here is that these defenses address content-based attacks but leave structure-based attacks (fake control tokens, formatting mimicry) wide open. That's a genuine diagnostic insight: it explains a failure mode that practitioners have observed empirically but couldn't isolate. On integrity, the paper operates in a 'toy setting' for the adversarial training experiments — the authors are explicit about this. The linear probe detection results are shown 'across different settings,' but the abstract doesn't specify whether those settings include real-world agentic pipelines or remain synthetic. This is the critical gap: a probe that works on curated conversations may not generalize to the messy, multi-tool chains where spoofing actually matters. The two-channel decomposition (content vs. structure) is a clean framework, but its completeness is assumed rather than proven — there may be attack vectors that don't fit neatly into either bucket. The milestone math is straightforward. Today: linear probes detect spoofing in controlled settings. Next: detection that works in production agentic systems with real tool calls, real web retrieval, and adversarial actors actively trying to evade the probe. The gap is not primarily compute — it's evaluation infrastructure. The field doesn't yet have a standardized red-team benchmark for role spoofing in deployed agents, which means every paper in this space is grading its own homework to some degree. The obvious experiment not run: deploying the linear probe detector in a live agentic system (e.g., a browsing agent or code-execution agent) and measuring false-positive rates under realistic workloads. The honest read is (a) — this requires engineering infrastructure and access to production-scale agents that an academic team likely doesn't have. The adversarial training result in a toy setting also begs for scale: does the content-vs-structure vulnerability decomposition hold in frontier models with billions of parameters, or is it an artifact of smaller models?
