# Tokenizer-Side Mitigation

Holding bytes identical and changing only whether forged chat-template markers are encoded as reserved token ids or as ordinary subwords, this study measures the resulting gap in indirect prompt-injection success on LLM agents in InjecAgent, finding an identity gap of 39 to 66 percentage points on Llama-3.1, GLM-4.5 and Seed-OSS-36B while Qwen3-8B draws most of its attack from marker text, and further showing that the authority lives in the single learned input vector at the marker position and that the standard tokenizer-side mitigation misses the tool-protocol tokens that carry tool output.

Holding bytes identical and changing only whether forged chat-template markers are encoded as reserved token ids or as ordinary subwords, this study measures the resulting gap in indirect prompt-injection success on LLM agents in InjecAgent, finding an identity gap of 39 to 66 percentage points on Llama-3.1, GLM-4.5 and Seed-OSS-36B while Qwen3-8B draws most of its attack from marker text, and further showing that the authority lives in the single learned input vector at the marker position and that the standard tokenizer-side mitigation misses the tool-protocol tokens that carry tool output.