Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?