Prompt-Injection Tests Need More Than Text Logs

An agent's prompt log can look complete and still leave out a condition that changes what the model received. For builders, that matters when a tool result or retrieved document is untrusted: the visible text may be the same while the model-facing representation is not.

The signal

In Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection, Yan Zhan and colleagues compare forged chat-template markers with byte-identical text encoded in different ways. One version reaches the model as its reserved control tokens. Another reaches it as ordinary subword tokens. A request log would display the same characters for both.

Across three of four selected open-weight model families in the authors' self-hosted setup, the ordinary-subword version lowered InjecAgent attack success by 39 to 66 percentage points. On a held-out 409-pair AgentDojo split, the reported gap between matched and split representations was 10.3 points for Qwen3-8B and 6.8 points for Qwen3-32B.

That is a narrow but useful contradiction. A rendered prompt or request body can be accurate as text without fully identifying the representation that a target passed to a model.

What WTK should bind

Think about a support agent that reads a tool response containing text that resembles a chat boundary. The tool response can be logged verbatim. Yet the chat template, tokenizer, special-token configuration, and the rule that marks the response as untrusted can determine whether those characters arrive as ordinary content or as a model-recognized control marker.

WTK already treats qualification as evaluation of a specified package in a specified execution environment, not a universal property of the package. A portable package does not qualify its runtime explains why a runtime is part of the claim. This paper sharpens the point: for an untrusted-input authority claim, the relevant target identity can include its rendering and tokenization path, not only its model name or visible prompt.

The practical addition is modest. A qualification receipt should either retain the applicable chat template, tokenizer, special-token configuration, and untrusted-span handling rule, or explicitly say that the target does not expose that information. A clean-looking text transcript should not quietly stand in for an inaccessible execution detail.

The boundary

The paper studies selected self-hosted open-weight models, vLLM conditions, InjecAgent, and AgentDojo. It does not establish that any WTK target, hosted API, or production agent accepts these representations or has the reported exposure.

It also is not a complete defense recipe. The authors report that a common special-token split misses reachable tool-protocol tokens in 33 of 67 sampled tokenizer configurations, covering 255 of 400 selected checkpoints. Their adaptive spelling search also recovers much of the default defense's benefit in its reported setting, and the benign-utility comparison is limited and not statistically significant.

So we should not convert a tokenizer setting into an authorization claim. The authority boundary still comes from the package contract and enforced action controls. The representation detail tells us whether a target-local negative test is genuinely the same execution condition.

The WTK test

Before WTK could make a target-level claim about handling untrusted input, its evidence would need to bind the package digest, compiled target, runtime and model binding, chat template, tokenizer configuration, span-handling rule, fixture, and action oracle. If a target does not make a representation observable or controllable, that limitation belongs in the receipt.

WTK has not run such a target review or adopted a tokenization policy. This is an external mechanism signal, not a WTK finding or a reason to expose token IDs to agents. Our research question is simpler: when identical text can mean different executed input, what evidence lets a qualification claim say which one it tested? WTK's research method keeps that question separate from a deployed safety conclusion.

Source and review boundary

Yan Zhan, Yunze Song, Mengkai Hou, Wanting Zhang, Shaobo Liu, Zhijun Gao, Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection, arXiv:2609.35932v1, September 28, 2026. This is an external-research interpretation under the WTK research method, not a WTK Finding, an approved experiment, or an authorization to change a target.