Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection
Yan Zhan, Yunze Song, Mengkai Hou, Wanting Zhang, Shaobo Liu, Zhijun Gao
cs.CR, cs.AI, cs.LG
2026-09-28
Forged markers as subwords (same bytes) cut InjecAgent ASR 39-66 pp on three of four families; Qwen3-8B drops 8 pp, 50 with reasoning off.
Wrapping a malicious instruction in the model's own chat template (the markup that frames system, user, assistant and tool turns) makes prompt injection much stronger. ChatInject raised AgentDojo success from 5.18% to 32.05%. Prior work treats that as template syntax or role style. A forged marker such as <|imstart|> actually carries two properties at once: the visible string, and the reserved control token id with its learned input vector.
Those twelve characters can arrive as one reserved id or as six ordinary subwords, the pieces the tokenizer uses for everyday text. Both decode to the same bytes. Request bodies and audit logs look identical. The server-side tokenizer, not the attacker, chooses the ids. vLLM emits the reserved id for a marker sitting inside a tool result; Hugging Face's splitspecialtokens option emits subwords instead. Almost nobody measured that contrast with the bytes held fixed. Deng et al. split markers character by character on Qwen3-8B, watched target-call probability move from 100.00% to 99.99%, and concluded the attack lives in tag-like syntax. The fixed-bytes contrast asks how much of the injected instruction's authority comes from the reserved vector.
The attacker controls the bytes of one tool result and nothing else: not the system prompt, user task, tool schemas, or serving stack. Success means the model calls a tool the attacker named.
For each InjecAgent case the prompts share content, injection site, and tool set, and differ only in how forged markers are encoded:
The identity gap is Δ = ASR(Matched) − ASR(Split), paired within case. Four open-weight families with unrelated tokenizers: Qwen3-8B (32B as a scale check), Llama-3.1-8B-Instruct, GLM-4.5, Seed-OSS-36B-Instruct. 400 cases per attack type, temperature 0, greedy decoding, conditions of a configuration run together. A gap counts only if an exact paired test is significant in every repeat.
Matched stays within 1.7 pp of Reserved everywhere, so the extra tokens cost the attacker almost nothing. Once bytes and length match, dropping the reserved ids collapses the attack on three families.
| Model | Attack | Reserved | Split | Δ |
| Llama-3.1-8B | direct harm | 98.2% | 39.7% | +58.2 |
| Llama-3.1-8B | data stealing | 99.5% | 49.1% | +50.2 |
| GLM-4.5 | direct harm | 71.5% | 11.1% | +60.0 |
| GLM-4.5 | data stealing | 92.3% | 27.2% | +65.5 |
| Seed-OSS-36B | direct harm | 85.0% | 26.2% | +58.6 |
| Seed-OSS-36B | data stealing | 76.9% | 39.3% | +39.3 |
| Qwen3-8B | direct harm | 84.8% | 75.3% | +8.1 |
| Qwen3-8B | data stealing | 90.9% | 89.5% | +0.5 |
Llama, GLM and Seed sit at 39 to 66 pp. Qwen3-8B direct harm is 8.1 pp; data stealing is indistinguishable from zero. Qwen3 is reading the marker text: upper-casing the first letter costs Split 39 pp, while the same surface term is within 10 pp of zero on the other models. Suppressing Qwen3-8B's reasoning block widens the gap from 8.1 to 49.8 pp. Split falls from 75.3% to 35.8%; reserved-id conditions barely move. At 32B the direct-harm gap is 18.0 pp. Deng's null result is a ceiling: their readout already sat at 100%. Under an episode-success readout, a per-character split costs 54.2 pp on the same model.
The authority sits in the single vector at the marker position, a learned stamp that a new instruction-bearing turn has begun. Replacing it with the mean of the marker's subword vectors leaves Llama-3.1 at 58.4%. The nearest ordinary token in embedding space restores 98.4%, against 98.2% with the reserved vector. Another reserved control token keeps both models near full strength. Base models do not end their turn, so the comparison is the logit of the attacker's tool minus the user's, teacher-forced on the same prompts: in all three pairs the instruction-tuned checkpoint prefers reserved markers more.
On AgentDojo's held-out split of 409 task pairs, scored by the benchmark's execution-level security check, the gap is +10.3 pp on Qwen3-8B and +6.8 pp on Qwen3-32B. After reserved ids are stripped, an adaptive search over 115 to 133 spellings recovers most of the attack. On Llama, GLM and Seed the winning spelling is an embedding neighbour, within 1.6 to 12.2 pp of the undefended rate.
Anyone serving open-weight agents can run a measurement: same bytes, tokenizer either emits reserved ids or it does not, and the difference estimates how much the existing switch actually blocks. That switch only re-encodes tokens declared special. Among the 400 most-downloaded chat models on Hugging Face, 33 of 67 distinct tokenizer configurations, covering 255 checkpoints, leave tool-protocol tokens such as <toolresponse> outside its reach. A forged block built only from those tokens still produces gaps of 9.4 to 19.9 pp. That is the channel agents use to read untrusted tool output.
Training-time defences such as StruQ and SecAlign can run the same fixed-bytes contrast to see whether they remove this vector or only the strings that trigger it. Attack papers that report the template string without the token ids mix the two mechanisms.
The default attack rides the reserved id. An adaptive attacker follows the representation, and an ordinary neighbour token can carry the authority back.
The authors flag three. The study covers self-hosted open-weight models where the deployer controls tokenization; hosted APIs that accept only strings are out of scope. InjecAgent scores the next-turn tool call; execution-level success is measured only on AgentDojo. The vector swaps edit the model's input, not bytes an attacker can send.
A few gaps stay open. The Qwen3-8B data-stealing identity gap never establishes, and plaintext already succeeds on 41.6% of those cases, so the Qwen family cannot be summarised as mostly the vector. The adaptive neighbour is selected on calibration cases then evaluated on held-out ones; a real attacker may not have that channel. The source-aware encoder in the appendix is not compared end-to-end against StruQ or spotlighting. GLM-4.5 runs in FP8, so its absolute rates should not be used to rank families.