Holding the injected instruction fixed and changing only the preceding delimiter, the objective-A forged-turn average decomposes into 62.4% success with no delimiter, 92.8% behind ordinary delimiter text, and 99.9% behind reserved identifiers: +30.4 points attributable to surface appearance and +7.1 to the identifier. For objective B, the corresponding averages are 85.0%, 92.0%, and 90.8%, yielding +7.0 surface points and −1.2 identifier points, with substantial model-level variation and negative identifier terms on three models.

model: Gemma-4-31B · component: Absent · objective: Objective A

model: Gemma-4-31B · component: Text · objective: Objective A

model: Gemma-4-31B · component: Reserved · objective: Objective A

model: Gemma-4-31B · component: Surface · objective: Objective A

model: Gemma-4-31B · component: Identifier · objective: Objective A

model: Llama-3.1-8B · component: Absent · objective: Objective A

model: Llama-3.1-8B · component: Text · objective: Objective A

model: Llama-3.1-8B · component: Reserved · objective: Objective A

model: Llama-3.1-8B · component: Surface · objective: Objective A

model: Llama-3.1-8B · component: Identifier · objective: Objective A

model: Ministral-3-8B · component: Absent · objective: Objective A

model: Ministral-3-8B · component: Text · objective: Objective A