Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection

Yan Zhan, Yunze Song, Mengkai Hou +3

Prompt injection against LLM agents becomes much stronger when the injected instruction is wrapped in the model's own chat template. A forged template marker such as <|im_start|> c…