Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection

Same Bytes, Different Authority. Reserved-Token Representations in Chat-Template Prompt Injection. By Yan Zhan and five others, from Peking University, the National University of Singapore, and two other institutions. Published on the twenty-eighth of September. Its code repository is public and real: sixteen source files.

Prompt injection against LLM agents gets much stronger when the injected instruction is wrapped in the model's own chat template, complete with forged markers like the one that opens a new turn. Such a marker can reach the model in two ways: as a single reserved control token, or as a run of ordinary subword tokens. Both decode to exactly the same text. The claim here is that much of the injected instruction's authority does not come from that text at all. It sits in the learned representation of the reserved token, in a single vector at the marker's position.

The experiment exploits a simple fact about deployment. Tokenization happens on the server, so it is the defender, not the attacker, who decides which form the model receives. The authors hold the text fixed, encode the forged markers as subwords, and control for the extra tokens this adds. On the InjecAgent benchmark that lowers attack success by thirty-nine to sixty-six percentage points on three of four open-weight families, and the gap carries over to multi-turn agent tasks in AgentDojo.

The fourth family is the instructive exception. On Qwen3-8B the gap is only eight points, because even without reserved ids the model still recognises the forged turn from its text, by reasoning about it. Suppress the reasoning block and the gap widens to fifty.

Several probes pin the authority to the vector itself. Averaging the marker's subword vectors does not reproduce it. Substituting the vector of the nearest ordinary token restores the attack on Llama-3.1. And an adaptive attacker who searches for markers that are not reserved finds such embedding neighbours on three of four families. In every base and instruction-tuned pair tested, instruction tuning strengthens the model's preference for reserved markers.

That leads to the standard mitigation, a tokenizer option that encodes special tokens as ordinary subwords. It only applies to tokens a configuration declares special. In thirty-three of sixty-seven distinct tokenizer configurations, covering two hundred and fifty-five of the four hundred most downloaded chat models on Hugging Face, it leaves the tool-protocol tokens untouched. Those are the tokens through which agents read untrusted tool output, and on that channel the gap persists.

The measurements cover four open-weight families, with InjecAgent for single attacks and AgentDojo for multi-turn tasks. The effect is not uniform: one family shows a small gap because its reasoning recovers the forged turn from text alone, and the large gaps belong to the other three. The finding about instruction tuning holds in every pair tested, and the mitigation audit concerns the configurations of the most downloaded chat models on one hub.

Two strings that look identical on the page can carry very different weight inside a model, depending on which token ids spell them. That makes tokenization a defensive lever, and it also exposes a hole in the usual fix: the tokens agents use to read tool output often fall outside what the fix protects.