Isn't the first section no-longer accurate for several years? I understood that, while we serialize the end of turn markers in a text format like `</think>`, internally they are a dedicated token that cannot be forged (a user message containing `</think>` would encode to a different sequence of tokens). Am I mistaken about this?

Obviously, this doesn't really affect the results of the paper, but it feels like it's the obvious first-line of defense: at least the model has a solid fence between the different roles.

Yeah, the footnote/sidenote on the paper (the one labeled #2) mentions this as well so you can't type that directly

It feels like sometimes researchers find something someone is already doing in the wild, undertake a study on it, but the speed of research and study doesn't match or cover the progress or rate of change by the time it's published, so with AI research specifically, too many studies can feel like they're in the past.