It's only an issue with LLMs. And it's because they're generative, text completion engines. That is the actual learned task, and it's a fixed task.

It's not actually a chat bot. It's completing a chat log. This can make it do a whole bunch of tasks, but there's no separation of task description and input.

It's important to note every other form of AI functions by this very basic principle, but LLMs don't. AI isn't a problem, LLMs are.

The phrase "translate the word 'tree' into German" contains both instructions (translate into German) and data ('tree'). To work that prompt, you have to blend the two together.

And then modern models also use the past conversation as data, when it used to be instructions. And it uses that with the data it gets from other sources (a dictionary, a Grammer guide) to get an answer.

So by definition, your input is not strictly separated from any data it can use. There are of course some filters and limits in place. Most LLMs can work with "translate the phrase 'dont translate this' into Spanish", for example. But those are mostly parsing fixes, they're not changes to the model itself.

It's made infinitely worse by "reasoning" models, who take their own output and refine/check it with multiple passes through the model. The waters become impossibly muddled.

From my understanding, most LLMs work by repeatedly putting the processing output back into the input until the result is good enough. This means that in many ways the input and the output are the same thing from the perspective of the LLM and therefore inseparable.

Maybe i misunderstand what you mean but yes, you kind of can. The problem in this case is that the user sends two requests in the same input, and the LLM isn't able to deal with conflicting commands in the system prompt and the input.

The post you replied to kind of seems to imply that the LLM can leak info to other users, but that is not really a thing. As I understand when you call the LLM it's given your input and a lot of context that can be a hidden system prompt, perhaps your chat history, and other data that might be relevant for the service. If everything is properly implemented any information you give it will only stay in your context. Assuming that someone doesn't do anything stupid like sharing context data between users.

What you need to watch out for though, especially with free online AI services is that they may use anything you input to train and evolve the process. This is a separate process but if you give personal to an AI assistant it might end up in the training dataset and parts of it end up in the next version of the model. This shouldn't be an issue if you have a paid subscription or an Enterprise contract that would likely state that no input data can be used for training.