Can Models Learn to Separate Instructions from Data? Durable Property vs Training Gap

Durable at the level that matters: the instruction/data boundary is trainable one delimiter at a time (hardening drives instruction injection to ~0%) but not in general — each closed boundary relocates the attack to the next finer one (instruction→data, then trusted→untrusted data), because the root cause is the LLM's probabilistic reading of inexact structural delimiters, an architectural fact. Newer models lower the per-boundary success rate but never produce a clean separation, and part of that gain is benchmark familiarity, not measured adaptive robustness — so the standing prescription across the cluster is to enforce the boundary outside the model with a deterministic action/data gate