Pillar Security
App and infrastructure security company whose research line runs through the chat-template layer of local-ai-threat-layers. The July 2025 post, “LLM Backdoors at the Inference Level”, introduced the attack class: malicious instructions embedded in a GGUF’s Jinja chat template that execute nothing and only activate when a trigger phrase appears in the prompt, dormant and scan-invisible otherwise https://www.pillar.security/blog/llm-backdoors-at-the-inference-level-the-threat-of-poisoned-templates. The February 2026 follow-up, “From Discovery to Large-Scale Validation”, tested trigger-activated template backdoors across 18 models and repeated the key evaluations on four inference engines, llama.cpp, Ollama, vLLM, SGLang, with consistent results https://www.pillar.security/blog/from-discovery-to-large-scale-validation-chat-template-backdoors-across-18-models-and-4-engines. The formal write-up is arXiv 2602.04653, “Inference-Time Backdoors via Chat Templates: From LLM Supply Chains to Agentic System Compromise”, authors Ariel Fogel, Omer Hofman and colleagues https://arxiv.org/abs/2602.04653.
Their framing of why the layer matters: modifying a template and re-uploading does not require training access, infrastructure control, or runtime exploitation, and the model behaves normally until the trigger phrase appears. That is the purest form of the instruct-versus-execute distinction this section keeps circling. See 2026-10-21-youtube-kai-local-ai-privacy.
Sources
- Poisoned templates post, 2025-07-09: https://www.pillar.security/blog/llm-backdoors-at-the-inference-level-the-threat-of-poisoned-templates
- 18-models validation, 2026-02-10: https://www.pillar.security/blog/from-discovery-to-large-scale-validation-chat-template-backdoors-across-18-models-and-4-engines
- arXiv 2602.04653: https://arxiv.org/abs/2602.04653