Why prompt injection works: a Transformer-level view
medium.com