Prompt Injection as Role Confusion

I may have missed it but I wasn't sure from the page what CoT stood for (I'm not an AI person), but I saw in the arxiv pdf that it mentions "chain of thought." Anyway, interesting to see how it relies more on style than tags. I wonder if anyone will try training with the tag as a per token input, not something the model tries to figure out for itself.