Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection
Forged chat-template markers can carry authority through a single reserved token, even when the visible text is identical.
The paper tests prompt injection where markers such as `<|im_start|>` are encoded either as reserved control tokens or ordinary subword tokens. Holding the text fixed, subword encoding cut attack success by 39 to 66 points on three of four open-weight model families in InjecAgent, with similar effects in AgentDojo. The authors trace the effect to the learned vector for the reserved marker, not the marker text alone. They also report that common tokenizer mitigation misses many tool-protocol tokens across Hugging Face chat model configurations. HF Daily Papers' note
The paper tests prompt injection where markers such as `<|im_start|>` are encoded either as reserved control tokens or ordinary subword tokens. Holding the text fixed, subword encoding cut attack success by 39 to 66 points on three of four open-weight model families in InjecAgent, with similar effects in AgentDojo. The authors trace the effect to the learned vector for the reserved marker, not the marker text alone. They also report that common tokenizer mitigation misses many tool-protocol tokens across Hugging Face chat model configurations. HF Daily Papers' note
score 5