Inference-time backdoor via chat template: from LLM supply chain to agent system compromise
Inference-Time Backdoors via Chat Templates: From LLM Supply Chains to Agentic System Compromise
Quick read
Based on 论文全文 （AI 生成）; refer to the original
The researchers propose an inference-time backdoor attack based on the chat template: an attacker only needs to tamper with the Jinja2 chat template in a GGUF model and redistribute it, without modifying model weights, poisoning training data, or controlling the deployment environment. Across 18 models, 7 model families, and 4 inference engines, factual accuracy drops on average from 90% to 15% after triggering, and the success rate of inducing the model to output an attacker URL exceeds 80%, with no measurable degradation when not triggered. At the agent level, the backdoor hijacks tool calls across 3,868 episodes in AgentDojo and Agent Security Bench, bypassing the benchmarks' provided injection defenses, with Mistral-8B achieving an attack success rate of 0.830 on ASB. The authors also demonstrate two deployment cases, BrowserUse and OpenHands, and report that the poisoned artifacts pass all of Hugging Face's automated security scans.
- 开放权重模型以 GGUF 等单文件形式分发，其中捆绑的 chat template（多为 Jinja2 可执行程序）在每次推理前运行，却缺乏来源验证。作者认为这构成一个此前未被系统刻画、且当前无人防守的供应链攻击面。
- 攻击者只需从下载的 GGUF 中提取 chat template，替换为带后门的版本再重新分发，不改权重、不碰训练数据、不控制部署环境。后门在检测到触发短语时向 system 上下文注入攻击者指令，否则输出与原始模板完全一致。
- 在 18 个模型、7 个家族、4 个推理引擎上，触发后事实准确率平均从 90% 降至 15%，诱导输出攻击者 URL 的成功率超过 80%，良性输入无退化。在 AgentDojo 与 ASB 共 3,868 个 episode 中劫持工具调用，绕过所有测试的注入防御；两个真实部署案例分别泄露支付凭证和向下游传播供应链代码投毒。投毒产物通过 Hugging Face 全部自动安全扫描。
- 模型层只评估了完整性与禁止资源输出两类目标；攻击成功率与指令遵循能力的相关性未确立因果关系。防御实验仅限每家族一个模型、单一基准；发布方审计与自动异常检测能否在生态规模落地仍待未来工作。作者称已向 Hugging Face 和 LM Studio 披露，双方均未承诺修复。
The paper shows that merely tampering with the GGUF chat template can implant an inference-time backdoor, and validates its success rate and stealth across 18 models and agent benchmarks.