My intent is to multiply probabilities. If that’s implemented by adding log-odds, that’s fine. Slightly faster, even.
I thought I remembered that the last neuron gave odds which got sampled, but if you’ve gotten into the guts of these things more recently and say it’s log-odds, I’ll believe it. Though anyone implementing this should double-check what their specific net does, in case it’s weird.
Why put role tags into the text stream where an attacker can imitate them in the first place? You could apply the tags post-tokenization and just use reserved token codes the tokenizer never uses. If for some reason you can’t do that, you could at least mark them with unicode reserved characters and filter those out of all input streams.