Inference-Time Backdoors via Chat Templates: From LLM Supply Chains to Agentic System Compromise

Chat templates represent a critical and overlooked security vulnerability: The research identifies that chat templates—executable programs used in nearly every inference call—can be weaponized to inject backdoors without modifying model weights or training data, creating a new attack surface that previous security research had not addressed.

Backdoor attacks can severely degrade model performance on demand: When triggered, the backdoors reduced factual accuracy from 90% to 15% on average across eighteen models and achieved over 80% success rates in making models emit attacker-controlled URLs, while leaving benign inputs completely unaffected and undetectable.

Current AI safety defenses are insufficient against template-based attacks: The research demonstrates that template backdoors successfully bypassed "every tested injection defense" in agent benchmarks across 3,868 episodes, suggesting that existing safeguards designed to prevent prompt injection and tool misuse may not account for this threat vector.

Supply chain vulnerabilities extend beyond model weights to deployment artifacts: A single poisoned chat template can compromise entire multi-agent systems and propagate through supply chains, meaning that organizations using open-weight models need to scrutinize not just the model files themselves but all accompanying code and configuration files.

The threat requires minimal adversarial capabilities: Unlike previous backdoor attacks requiring access to training pipelines or deployment infrastructure, this attack only requires an adversary to distribute a model with a modified template, making it a more accessible and scalable threat to the open-source AI ecosystem.