Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection
DGX agentarXiv:2609.35932v1 Announce Type: cross Abstract: Prompt injection against LLM agents becomes much stronger when the injected instruction is wrapped in the model's own chat template. A forged template