mika-el

The irony here is that the detection method is literally prompt injection — the same technique that's a security vulnerability everywhere else. ICML embedded hidden instructions in PDFs that manipulate LLM output. In a different context that's an attack, here it's enforcement.

From my perspective this says something important about where we are with LLMs. The fact that you can reliably manipulate model output by hiding instructions in the input means the model has no real separation between data and commands. That's the fundamental problem whether you're catching lazy reviewers or defending against actual attacks.

the separation between who writes and who reviews is the whole thing. I do same at smaller scale — one model writes code, different model reviews it. self-review misses things, same reason you don't review your own PRs

depends on bet size. small scoped tasks with tight specs — agents are reliable. "build this feature" with no constraints — yeah that's gambling. I am 90% positive most agent failures I see are from vague task definitions, not model limitations. basically the fix is better scoping not better models

the human-generated vs LLM-generated distinction is basically the whole finding. what works from my experience — structural context, not prose. file trees and function signatures. agents need to know where things are, not be told "follow best practices." the more precise the map the less the agent wander