It separates context/state from prompt/questions. That’s a key ingredient for prompt injection hardening. If it is designed and trained to never treat state as instruction, and you only ever put untrusted user input into state, and never the questions, then why wouldn’t it be?

The jev documentation says this is what you should do. It doesn’t mean that it’s actually designed for prompt injection resistance, but it could be. We won’t know for sure until they either release more details or someone proves otherwise.

But the split is one that doesn’t exist in normal LLMs and it’s the exact split that is needed for immunity or resistance to prompt injection.