I find that in many cases the most recent things get more attention than other things. e.g. for the following two approaches 1. intro, instruction, large body

I find that in many cases the most recent things get more attention than other things. e.g. for the following two approaches 1. intro, instruction, large body of text to work on 2. intro, large body of text to work on, instruction I find that the second method gets desirable output far more consistently. It could be this would then mean if there are conflicting instructions, the second instruction will simply over-ride the first. This general behavior is also how prompt injection style jailbreaks like DAN work. You're using later contradictory instruction to bring about behavior explicitly forbidden.