研究库 论文知识库

内容库 / 论文

arXiv:2609.35932 · Agent 智能体

Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection

Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection

类型：arxiv
标识：2609.35932
链接：https://arxiv.org/abs/2609.35932
主分类：agent
形态：method
TLDR：Prompt injection against LLM agents becomes much stronger when the injected instruction is wrapped in the model's own chat template. A forged template marker such as <|im_start|> can reach the model either as a single reserved control token or as a sequence of ordinary subword tokens. The two decode to exactly the same text, and because tokenization runs on the server, the defender rather than the attacker decides which one the model receives. We use this to measure how much of the injected instruction's authority comes from the reserved token's learned representation. Encoding the forged mark
待LLM分类：否
来源文件：
/inbox/tom/_candidates/2026-09-30-agent-rag-longcontext-candidates.json

相关 · 按语义匹配

笔记精读与批判 v2 · MMProLong — 长上下文 VLM 继续预训练（LongPT）配方 · 2026-09-14 (重写覆盖)

笔记精读与批判 · Prompt-Model Interaction Reaches the Fixed Points (arXiv:2608.21315)

笔记 2026-09-05 精读批判 | 多模态长文档 RAG 与高效 VLM · v2 覆盖版

笔记 Tom 文献雷达 · AI Agent / RAG / 长上下文 · 2026-08-03 晚间

仓库 LearnPrompt/humanize-ppt

仓库 BradyFU/Awesome-Multimodal-Large-Language-Models

arXiv

2609.35932

TLDR

Prompt injection against LLM agents becomes much stronger when the injected instruction is wrapped in the model's own chat template. A forged template marker such as <|im_start|> can reach the model either as a single reserved control token or as a sequence of ordinary subword tokens. The two decode to exactly the same text, and because tokenization runs on the server, the defender rather than the attacker decides which one the model receives. We use this to measure how much of the injected instruction's authority comes from the reserved token's learned representation. Encoding the forged mark

arXiv ↗ 中文全文