It does make a difference and does not become just context.
replySee https://cookbook.openai.com/articles/openai-harmony
There is no guarantee that will work 100% of the time, but effectively there is a distinction, and I'm sure model developers will keep improving that.
The lack of a 100% guarantee is entirely the problem.
replyIf you get to 99% that's still a security hole, because an adversarial attacker's entire job is to keep on working at it until they find the 1% attack that slips through.
Imagine if SQL injection of XSS protection failed for 1% or cases.