> The input is represented as tokens, wherein the trusted instructions and the untrusted instructions are represented using incompatible token sets.

Yes, exactly!

This is the deterministic fix that all the heuristic defenses are approximating. Separate token vocabularies for trusted and untrusted context would make the trust boundary architectural rather than probabilistic -- the model literally cannot confuse a retrieved document with a system instruction because they don't share a token space.

The gap between "patented" and "deployed in production inference infrastructure" is the interesting question. Do you know if anyone is actually implementing this in a shipping model or is it still purely research?