Keep in mind that LLMs are essentially just large text predictors. Prompts aren’t so much instructions as they are setting up the initial context of what the LLM is trying to predict. It’s an algorithm wrapped around a giant statistical model where the statistical model is doing most of the work. If that statistical model is relied on to also control or limit the output of itself, then that control could be influenced by other inputs to the model.
Also they absolutely want the LLM to read user input and respond to it. Telling it exactly which inputs it shouldn’t respond to is tricky.
In traditional programs this is done by “sanitizing input”, which is done by removing the special characters and very specific keywords that are generally used when computers interpret that input. But in the case of LLMs, removing special characters and reserved words doesn’t do much.
