Paper Published: Aug 2, 2026

Poisoned GGUF Chat Templates Backdoor Inference Without Changing Model Weights

Researchers from Pillar Security and Fujitsu showed that a GGUF artifact can carry a modified Jinja chat template while its model weights remain unchanged. When a trigger appears, the inference engine renders attacker instructions into system-level context before the model runs; controlled tests degraded model behavior and hijacked BrowserUse and OpenHands tool use. Defenders need to treat chat templates as executable release artifacts, verify their exact bytes and provenance, regression-test every conversion, and enforce tool and data-flow boundaries.

Supply Chain CompromiseMalicious ModelsModel ProvenanceSupply Chain DefenseAI Supply Chain
4 applicable AIDEFEND defenses
Source: Inference-Time Backdoors via Chat Templates: From LLM Supply Chains to Agentic System Compromise 
Authors: Ariel Fogel, Omer Hofman, Eilon Cohen, Roman Vainshtein
Original article: Feb 4, 2026

Threat Analysis

  • The attacker changes the template, not the weights. A legitimate open-weight model is repackaged with malicious Jinja logic in its GGUF chat template and redistributed as a plausible model artifact.
  • The inference engine activates the backdoor. On every request, the engine renders the bundled template before tokenization. A matching phrase or field lets the template insert attacker instructions into system-level context.
  • The behavior remained dormant until triggered. Across 18 models, seven families, and four inference engines, the paper measured severe triggered accuracy loss and reliable attacker-link emission while preserving normal behavior outside the trigger.
  • Agent tools turned model manipulation into system impact. Controlled BrowserUse and OpenHands demonstrations redirected synthetic payment and personal data, inserted attacker code, and exposed test credentials.
  • This was controlled research. The BrowserUse demonstration used a mock storefront, synthetic data, and a loopback receiver; the OpenHands demonstration used researcher-controlled infrastructure and test credentials. The sources do not report malicious exploitation against real users.

Applicable AIDEFEND Defenses (4)

AID-H-007.006
Post-Training Optimization & Format-Conversion Safety Regression
Very High
Treat every GGUF conversion or repackaging step as a security-relevant transformation. Bind the candidate to approved source bytes and conversion settings, then compare both artifacts on the same signed suite for trigger-conditioned behavior, instruction-hierarchy changes, leakage, and tool-policy violations. Block promotion when lineage is missing or any security category regresses.
AID-H-003.002
CI/CD Release Gating, Model Artifact Signing & Secure Distribution
Very High
Production should load only reviewed, signed, digest-pinned GGUF bytes from an internal mirror. The promotion gate should verify the artifact source, complete digest, bundled template, loader policy, regression evidence, and approval record before deployment or hot reload. A public model name or unchanged weight hash is not sufficient admission evidence.
AID-H-003.006
Model SBOM & Provenance Attestation
High
Bind the complete GGUF digest, model format, source, loader commit, tokenizer, and configuration evidence into a signed model SBOM and attestation. Verify the signature, predicate, signer identity, and actual artifact digest before admission and every load. This proves that the runtime received the approved bytes; it does not determine whether the bundled Jinja logic is semantically safe.
AID-H-018.005
Value-Level Capability Metadata & Data Flow Sink Enforcement
Medium
For BrowserUse or another live action that actually passes through the governed dispatcher, require a server-side content identifier for payment fields, personal data, credentials, or repository content. Deny labelled content at attacker-controlled network, write, or file sinks, and keep agent egress default-deny. This control does not govern an OpenHands-generated script after the code leaves that dispatcher.

What Defenders Should Do Now

  • Inventory every deployed model artifact, including its bundled chat template. Do not treat a matching weight hash as proof that the complete GGUF is unchanged.
  • Build or convert GGUF artifacts from reviewed source inside a controlled pipeline, mirror the result internally, sign the complete digest, and pin that digest at every load and reload.
  • Extract and canonicalize each chat template, compare it with an approved provider or build baseline, and review unexpected Jinja control flow, trigger conditions, role insertion, or external instructions as code changes.
  • Run pre-conversion and post-conversion security regressions with benign prompts, trigger-like inputs, system-context integrity checks, leakage probes, and tool-policy tests. Record both false positives from legitimate customization and missed triggers.
  • Give model-loading and agent-tool runtimes no long-lived secrets, shared home directory, or unrestricted egress. Use synthetic secrets to verify that data-flow policy blocks browser, code, file, and network exfiltration.
  • Quarantine any GGUF whose complete provenance, template baseline, or transformation evidence cannot be established, then replace it with a newly built and attested artifact.

1 additional consideration

Generated code outside the governed sink

The current value-level sink guidance governs classified dispatcher calls with server-side content identifiers. It does not prove that code generated by an agent will remain inside that enforcement path when a user later runs it in a browser or another environment.
Recommendation: Treat generated code as an untrusted artifact: review and test it in an isolated environment, remove ambient credentials and arbitrary egress, and require deployment-time browser, filesystem, repository, and network policy before it can reach real sessions or data.

Conclusion

Model supply-chain trust cannot stop at the weight tensors. A GGUF chat template participates in prompt construction on every inference, so changing it can alter model and agent behavior without touching the weights defenders usually verify. Strong deployments make the template part of the signed artifact contract, test each derived build for security regressions, and keep tool and data-flow policy outside the model's control.