Chat Template Backdoors: LLM Supply Chain Attack Without Touching Weights

Chat template backdoors let attackers compromise LLM-powered systems without touching model weights, training data, or deployment infrastructure. Researchers from a team presented at ICLR 2026 demonstrated that modifying the Jinja2 chat templates bundled inside model files is sufficient to reliably hijack both model outputs and agentic tool-use, while evading the prompt injection defenses that teams typically rely on.

The paper, “Inference-Time Backdoors via Chat Templates: From LLM Supply Chains to Agentic System Compromise” (arXiv:2602.04653), documents an attack class that exploits a structural property of how modern LLMs process input: the chat template runs before the model does.

What Chat Templates Are and Why They Matter

Most developers working with open-weight models interact with chat templates indirectly. When you send a message to a model, the inference framework (llama.cpp, Ollama, Hugging Face’s transformers, vLLM) first processes that message through a chat template before the model sees it. These templates are Jinja2 programs. They format conversation turns, inject system prompts, add special tokens, and handle multi-turn context assembly.

Templates ship bundled inside model files. For GGUF models, they are embedded in the file’s metadata. For Hugging Face model repositories, they live in tokenizer_config.json. Whoever controls the template controls what the model actually receives at inference time. That is a privileged position.

The researchers noted that chat templates occupy a position analogous to a pre-processor that runs with elevated trust: the model runtime executes Jinja2 code automatically, without user visibility or consent. There is no analogue to code review for template contents. There are no cryptographic provenance guarantees. And the attack surface covers every model download and every inference call.

The Attack Mechanics

The researchers implemented several backdoor variants:

Conditional output hijacking: The template includes logic that detects specific trigger phrases in user input and silently modifies the assembled prompt. On trigger, the model receives a manipulated context that reliably steers output toward attacker-controlled content, including fabricated URLs and misinformation. On non-trigger inputs, the template behaves identically to the legitimate version. The authors reduced factual accuracy from 90% to 15% on triggered inputs while leaving benign queries unaffected.

Agentic tool-use hijacking: In agent contexts, where models select and invoke tools, a poisoned template can intercept tool-selection prompts and inject instructions that redirect which tools are called and with what arguments. Across 3,868 test episodes, the backdoor successfully hijacked tool-use while bypassing injection defenses. The attack was effective against tool-use frameworks including those with explicit prompt injection guardrails, because the malicious logic runs upstream of the model’s safety reasoning.

Supply chain propagation: When a downstream project forks or quantises an upstream model, the poisoned template carries forward. The researchers demonstrated a single compromised artifact spreading through real-world agentic deployments. This is the most operationally concerning property: one compromised model on Hugging Face can propagate backdoors to dozens of derivative uploads.

A concurrent paper, “BadTemplate: A Training-Free Backdoor Attack via Chat Template Against Large Language Models” (arXiv:2602.05401), documented attack success rates up to 100% in controlled settings and showed the technique performs better than traditional prompt-based backdoors in persistence and evasion.

The Scale of the Exposure

The numbers frame the risk clearly. As of January 2026, Hugging Face hosts over 180,000 quantized models. Approximately 88% of those are in GGUF format. Around 2,600 include distinct custom chat templates. That 2,600 figure is not a ceiling: any model with a custom template is a potential delivery vehicle, and the barrier to uploading modified models to public repositories is low.

The attack does not require privileged access to model training infrastructure, cloud accounts, or deployment environments. An attacker needs only: write access to a public model repository, or the ability to convince a target to download and run their model. Given the culture of downloading and running models from Hugging Face without systematic review of template contents, this is a realistic threat.

The ICLR 2026 presentation confirmed the findings were validated against real deployment environments, not just laboratory conditions.

Why Existing Defenses Miss This

Standard defenses against model supply chain attacks focus on weight integrity: hash verification, provenance tracking, and anomaly detection in learned parameters. These are appropriate for catching tampered weights but structurally blind to template code.

Prompt injection defenses operate at the model’s input/output layer, detecting malicious content in user messages before the model processes them. Chat template backdoors execute before prompt injection defenses see any output, in Jinja2 code that runs in the inference framework, not inside the model. By the time safety filters evaluate the assembled prompt, the malicious template logic has already executed.

The researchers confirmed their poisoned artifacts passed security scans on major model distribution platforms. That is not a criticism of those platforms: scanning Jinja2 code for malicious logic is a harder, less mature problem than scanning files for known malware signatures.

Defensive Posture

A few controls reduce exposure, none of them eliminate the risk entirely.

Audit template code before deployment. Parse chat templates from model files and inspect them for conditional logic, especially branches that trigger on specific string matches. Jinja2 templates for legitimate use cases are generally short and structurally simple. Complex conditional logic in a template is a meaningful signal.

Pin verified model versions. Treat model downloads like dependency locks. Verify the hash of the downloaded file against a known-good value. When a model is updated, review the template diff before upgrading.

Prefer models with transparent template histories. Many well-maintained models use standard templates (Llama-3, Mistral, ChatML) with no custom modifications. Models with no custom template or a template that matches a well-known published standard present lower risk.

Treat template code as third-party code. This is the correct mental model. Chat templates are executable code that runs in your environment. They deserve the same security review as any other dependency.

The structural gap here is the absence of supply chain standards for model templates equivalent to what SLSA provides for software. Until template provenance, signing, and auditing become standard practice on model distribution platforms, teams relying on downloaded open-weight models carry supply chain risk that weight integrity checks alone do not address.