The problem is that the the LLM can't distinguish between data and instruction so there is just so much the harness can do.