Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection.

arXiv:2609.35932v1 Announce Type: cross Abstract: Prompt injection against LLM agents becomes much stronger when the injected instruction is wrapped in the model's own chat template. A forged template marker such as can reach the model either as a single reser