bassae  ·  field reference

The Chat-Template Threat Card

Every model ships a Jinja chat template — a program that runs on every prompt. Here are the seven ways it can turn on you, and the one-line tell for each. Read the template before you run it.

◆ ◆ ◆

1. Code execution (SSTI → RCE)

The template escapes Jinja and runs commands on your machine. CVE-2024-34359, CVE-2026-5760; sandbox escapes CVE-2024-56326 & CVE-2025-27516.

Looks like __globals__, |attr('format'), __init__, dunder chains, cycler.__init__.
The tell Any attribute traversal into dunders or a reference to format reached indirectly.

2. Hidden-instruction backdoor

Injected text the model obeys as system policy. Measured in arXiv:2602.04653: triggered accuracy 90% → 15%.

Looks like A literal system/override turn the stock template never had.
The tell Injected literal text with no counterpart in the known-good template.

3. Trigger-gated payload / time bomb

Dormant until a phrase or date fires. Sleeper Agents (arXiv:2401.05566): safety training won't remove it.

Looks like if 'phrase' in ..., strftime_now(...) compared to a date.
The tell Output gated on message content or the clock.

4. Content & tool tampering

The template removes or rewrites your messages and tools before the model sees them.

Looks like Dropped system turns, replace('do not','please'), reordered tool defs.
The tell A message or tool that does not survive the render verbatim, in its own role.

5. Data exfiltration

Injects an instruction to append your conversation to an attacker URL; your client fetches it.

Looks like A Markdown image/link to an external host with a query string of user text.
The tell Any URL emitted from template text, especially with encoded content.

6. Hidden text (ASCII smuggling)

Instructions in invisible Unicode Tags characters (U+E0000–U+E007F). Invisible on screen; read by the model.

Looks like An "empty" literal that isn't empty at the byte level.
The tell Tags-block code points in the raw bytes (UTF-8 prefix F3 A0).

7. Divergence from known-good

The repo page shows a clean template; the file on disk has one extra line.

Looks like Almost the stock template — plus or minus a clause.
The tell SHA-256 mismatch against the pinned, genuine template at that repo@revision.