Would llms be more robust to this prompt injection if the tags used in fine tuning are sanitised from user input?
E.g. map <think> -> THINK <user> -> USER <tool> -> TOOL
If they learn something specific in the chat finetuning stage, this might show LLM its user input text not these tag references.