This is the deterministic fix that all the heuristic defenses are approximating. Separate token vocabularies for trusted and untrusted context would make the trust boundary architectural rather than probabilistic -- the model literally cannot confuse a retrieved document with a system instruction because they don't share a token space.

The gap between "patented" and "deployed in production inference infrastructure" is the interesting question. Do you know if anyone is actually implementing this in a shipping model or is it still purely research?