{"id":"https://openalex.org/W7214980409","doi":"https://doi.org/10.48550/arxiv.2609.35932","title":"Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection","display_name":"Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection","publication_year":2026,"publication_date":"2026-09-28","ids":{"openalex":"https://openalex.org/W7214980409","doi":"https://doi.org/10.48550/arxiv.2609.35932"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2609.35932","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.35932","pdf_url":"https://arxiv.org/pdf/2609.35932","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2609.35932","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5153587885","display_name":"Yan Zhan","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I20231570","display_name":"Peking University","ror":"https://ror.org/02v51f717","country_code":"CN","type":"education","lineage":["https://openalex.org/I20231570"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhan, Yan","raw_affiliation_strings":["Peking University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Peking University","institution_ids":["https://openalex.org/I20231570"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5153616779","display_name":"Yunze Song","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I165932596","display_name":"National University of Singapore","ror":"https://ror.org/01tgyzw49","country_code":"SG","type":"education","lineage":["https://openalex.org/I165932596"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Song, Yunze","raw_affiliation_strings":["National University of Singapore"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Singapore","institution_ids":["https://openalex.org/I165932596"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5148163786","display_name":"Mengkai Hou","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I20231570","display_name":"Peking University","ror":"https://ror.org/02v51f717","country_code":"CN","type":"education","lineage":["https://openalex.org/I20231570"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hou, Mengkai","raw_affiliation_strings":["Peking University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Peking University","institution_ids":["https://openalex.org/I20231570"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5153560222","display_name":"Wanting Zhang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210133343","display_name":"BYD (China)","ror":"https://ror.org/03kkp9n92","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210133343"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhang, Wanting","raw_affiliation_strings":["BYD Company Limited"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"BYD Company Limited","institution_ids":["https://openalex.org/I4210133343"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5153672845","display_name":"Shaobo Liu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I180726961","display_name":"Shenzhen University","ror":"https://ror.org/01vy4gh70","country_code":"CN","type":"education","lineage":["https://openalex.org/I180726961"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Liu, Shaobo","raw_affiliation_strings":["Shenzhen University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Shenzhen University","institution_ids":["https://openalex.org/I180726961"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5153669638","display_name":"Zhijun Gao","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I20231570","display_name":"Peking University","ror":"https://ror.org/02v51f717","country_code":"CN","type":"education","lineage":["https://openalex.org/I20231570"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Gao, Zhijun","raw_affiliation_strings":["Peking University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Peking University","institution_ids":["https://openalex.org/I20231570"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.00019999999494757503,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/prompt-injection","display_name":"prompt injection","score":0.9890000224113464},{"id":"https://openalex.org/keywords/token-representation","display_name":"token representation","score":0.5410000085830688},{"id":"https://openalex.org/keywords/subword-tokenization","display_name":"subword tokenization","score":0.7760000228881836},{"id":"https://openalex.org/keywords/llm-based-agents","display_name":"LLM agents","score":0.8169999718666077},{"id":"https://openalex.org/keywords/agentdojo","display_name":"AgentDojo","score":0.7919999957084656},{"id":"https://openalex.org/keywords/instruction-tuning","display_name":"instruction tuning","score":0.6129999756813049},{"id":"https://openalex.org/keywords/attack-mitigation","display_name":"attack mitigation","score":0.4480000138282776}],"concepts":[{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.8720999956130981},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.656499981880188},{"id":"https://openalex.org/C2778112365","wikidata":"https://www.wikidata.org/wiki/Q3511065","display_name":"Sequence (biology)","level":2,"score":0.5044999718666077},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.486299991607666},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.4844000041484833},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.4830000102519989},{"id":"https://openalex.org/C2777210771","wikidata":"https://www.wikidata.org/wiki/Q4927124","display_name":"Block (permutation group theory)","level":2,"score":0.4514999985694885},{"id":"https://openalex.org/C42058472","wikidata":"https://www.wikidata.org/wiki/Q810214","display_name":"Base (topology)","level":2,"score":0.4309000074863434},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.42179998755455017},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.41620001196861267},{"id":"https://openalex.org/C94375191","wikidata":"https://www.wikidata.org/wiki/Q11205","display_name":"Arithmetic","level":1,"score":0.3330000042915344},{"id":"https://openalex.org/C2780009758","wikidata":"https://www.wikidata.org/wiki/Q6804172","display_name":"Measure (data warehouse)","level":2,"score":0.3294000029563904},{"id":"https://openalex.org/C21308566","wikidata":"https://www.wikidata.org/wiki/Q7169365","display_name":"Permutation (music)","level":2,"score":0.3280999958515167},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.32409998774528503},{"id":"https://openalex.org/C28490314","wikidata":"https://www.wikidata.org/wiki/Q189436","display_name":"Speech recognition","level":1,"score":0.30480000376701355},{"id":"https://openalex.org/C176982825","wikidata":"https://www.wikidata.org/wiki/Q835922","display_name":"Lexical analysis","level":2,"score":0.2962999939918518},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.29019999504089355},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.2847999930381775},{"id":"https://openalex.org/C2781249084","wikidata":"https://www.wikidata.org/wiki/Q908656","display_name":"Preference","level":2,"score":0.262800008058548}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2609.35932","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.35932","pdf_url":"https://arxiv.org/pdf/2609.35932","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2609.35932","doi":"https://doi.org/10.48550/arxiv.2609.35932","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2609.35932","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2609.35932","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.35932","pdf_url":"https://arxiv.org/pdf/2609.35932","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7214980409.pdf","grobid_xml":"https://content.openalex.org/works/W7214980409.grobid-xml"},"referenced_works_count":5,"referenced_works":["https://openalex.org/W4395064792","https://openalex.org/W4416529199","https://openalex.org/W4417136292","https://openalex.org/W6910538753","https://openalex.org/W7130711825"],"related_works":["https://openalex.org/W4415331423","https://openalex.org/W7163595244","https://openalex.org/W7147425754","https://openalex.org/W7214930238","https://openalex.org/W7161249974","https://openalex.org/W7137330798","https://openalex.org/W7220865121","https://openalex.org/W7149666770","https://openalex.org/W7204931828","https://openalex.org/W7212274194"],"abstract_inverted_index":{"Prompt":[0],"injection":[1],"against":[2],"LLM":[3],"agents":[4,292],"becomes":[5],"much":[6,79],"stronger":[7],"when":[8],"the":[9,15,29,51,59,61,65,70,81,87,93,99,107,116,132,144,153,157,166,170,178,183,186,189,197,200,205,238,276,287,298],"injected":[10,82],"instruction":[11,235],"is":[12,146],"wrapped":[13],"in":[14,140,177,266],"model's":[16,239],"own":[17],"chat":[18,279],"template.":[19],"A":[20],"forged":[21,94,158],"template":[22],"marker":[23,184],"such":[24,219],"as":[25,32,39,96,254],"<|im_start|>":[26],"can":[27],"reach":[28],"model":[30,71,154],"either":[31],"a":[33,40,104,247,261],"single":[34,179],"reserved":[35,88,151,242],"control":[36,105],"token":[37,203],"or":[38],"sequence":[41],"of":[42,80,127,188,199,224,268,275],"ordinary":[43,202,255],"subword":[44,191],"tokens.":[45],"The":[46,174,244],"two":[47],"decode":[48],"to":[49,76,121,136,172,259],"exactly":[50],"same":[52],"text,":[53],"and":[54,103,131,209,230,297],"because":[55,149],"tokenization":[56],"runs":[57],"on":[58,115,125,207,222,281,301],"server,":[60],"defender":[62],"rather":[63],"than":[64],"attacker":[66,212],"decides":[67],"which":[68,291],"one":[69],"receives.":[72],"We":[73],"use":[74],"this":[75,110],"measure":[77],"how":[78],"instruction's":[83],"authority":[84,175],"comes":[85],"from":[86,160],"token's":[89],"learned":[90,180],"representation.":[91],"Encoding":[92],"markers":[95,217],"subwords,":[97,256],"with":[98],"text":[100,162],"held":[101],"fixed":[102],"for":[106,215,241],"extra":[108],"tokens":[109,253,260,289],"adds,":[111],"lowers":[112],"attack":[113,206],"success":[114],"InjecAgent":[117],"benchmark":[118],"by":[119,163],"39":[120],"66":[122],"percentage":[123],"points":[124],"three":[126,223],"four":[128,225],"open-weight":[129],"families,":[130],"gap":[133,145,171,299],"carries":[134],"over":[135],"multi-turn":[137],"agent":[138],"tasks":[139],"AgentDojo.":[141],"On":[142],"Qwen3-8B":[143],"8":[147],"points,":[148],"without":[150],"ids":[152],"still":[155],"recognises":[156],"turn":[159],"its":[161],"reasoning;":[164],"suppressing":[165],"reasoning":[167],"block":[168],"widens":[169],"50.":[173],"sits":[176],"vector":[181,198],"at":[182],"position:":[185],"mean":[187],"marker's":[190],"vectors":[192],"does":[193],"not":[194],"reproduce":[195],"it,":[196],"nearest":[201],"restores":[204],"Llama-3.1,":[208],"an":[210],"adaptive":[211],"who":[213],"searches":[214],"non-reserved":[216],"finds":[218],"embedding":[220],"neighbours":[221],"families.":[226],"In":[227],"every":[228],"base":[229],"instruction-tuned":[231],"pair":[232],"we":[233],"test,":[234],"tuning":[236],"strengthens":[237],"preference":[240],"markers.":[243],"standard":[245],"mitigation,":[246],"tokenizer":[248,271],"option":[249],"that":[250,302],"encodes":[251],"special":[252],"applies":[257],"only":[258],"configuration":[262],"declares":[263],"special,":[264],"so":[265],"33":[267],"67":[269],"distinct":[270],"configurations,":[272],"covering":[273],"255":[274],"400":[277],"most-downloaded":[278],"models":[280],"Hugging":[282],"Face,":[283],"it":[284],"leaves":[285],"intact":[286],"tool-protocol":[288],"through":[290],"read":[293],"untrusted":[294],"tool":[295],"output,":[296],"persists":[300],"channel.":[303]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-10-01T00:00:00"}