im_end / im_start System Prompt Injection Format Markers

How the attack works

The attacker sends a message that looks like ordinary user text but contains raw ChatML or Llama-format control tokens. These tokens normally exist only in the underlying prompt template that separates system, user, and assistant turns. By inserting '<|im_end|><|im_start|>system' (or the Llama equivalent [INST]/<<SYS>>), the attacker tries to close the current user turn early and open a fake system turn, then follows it with instructions such as asking the model to reveal or summarize its hidden system prompt. If the model or its input pipeline doesn't strip or escape these tokens, it may interpret the injected text as a legitimate system message.

Netzilo detection

Why it matters

Successful injection can expose confidential system prompts, override safety or business-logic instructions, and redirect the model's behavior without the operator's knowledge.

What you can do

• →Sanitize or escape special formatting tokens (<|im_end|>, <|im_start|>, [INST], <<SYS>>) in all user-supplied input before it reaches the model.
• →Use a prompt template or API layer that structurally separates system and user content so injected tokens in user text cannot be reinterpreted as role markers.
• →Log and alert on user input containing these literal tokens outside of documentation or research contexts.
• →Test your specific model/template combination to confirm whether these tokens are actually parsed as structural markers, since risk varies by model family.

Known benign look-alikes

• Documentation and educational content that quotes these tokens as examples
• Security research reports describing token injection as a concept

References

• https://agentthreatrule.org/en/rules/ATR-2026-01463

Related threats