I used AI to help me understand what and where to do.
If you see anything I’ve written here that is not completely correct, say so and I’ll edit it as I can to reflect a useable method.
I have used the following instructions to successfully dump the metadata of a GGUF file to inspect the Template.
This process should be useful to inspect the Templates of any models you have downloaded.
If you find anything you think may be suspicious, post in this thread so knowledgeable people can assist and verify.
To inspect GGUF templates for malicious content I need to use a tool that can extract the GGUF Metadata.
The GGUF metadata contains the template.
It is possible to download a model, modify the template, then re-upload to a repo.
You can’t rely on Downloaded metrics in determining # of Downloads = safety, they can be Bot inflated.
I’m using Linux, Parrot OS ‘Hack The Box’ Edition (Not Omarchy), so I have lots of useful tools available should I need them.
I don’t use Windows, so I can’t provide any steps/instructions for Windows users to achieve similar results.
Anything python related should work on Windows, we have that for commonality.
In this example, I am using a GGUF file from it’s creator PrismML, downloaded within LMStudio.
It’s unlikely this GGUF is doing anything malicious, so it can be used as a test to see a ‘Known Good Example’.
Step 1. Download a model file
The file is located inside the dot file ‘.lmstudio’
(in LMStudio I have Bonsai-27B-GGUF directory with 2 .gguf files)
Step 2. Verify the files location:
$ cd ~/.lmstudio/models/Bonsai-27B-GGUF/
$ ls
Bonsai-27B-Q1_0.gguf mmproj-Bonsai-27B-BF16.gguf
To look for Malicious Template code I’ll be dumping the metadata for this file: Bonsai-27B-Q1_0.gguf
Step 3. Create the virtual environment (This step may not be required for some python users, running ‘python -m pip install gguf’ inside your shell should work.)
Using Python, Python3 for me, I need to set a Virtual Environment first, I have ‘system-managed Python packages’, then install the GGUF reader:
python3 -m venv ~/gguf-inspect-venv
source ~/gguf-inspect-venv/bin/activate
python -m pip install gguf
Run the inspection snippet from that same terminal.
When you’re done, type ‘deactivate’ to leave the virtual environment.
Avoid ‘–break-system-packages’; it can interfere with system-managed Python packages.
Step 4. Inspection: Dump the GGUF Metadata
$ python - <<'PY'from gguf import GGUFReader
path = "/full/path/to/your/model-file.gguf"reader = GGUFReader(path, "r")field = reader.fields.get("tokenizer.chat_template")
if field is None: print("No tokenizer.chat_template field found")else: print(field.contents())PY
Note: Replace the ‘/full/path/to/your/model-file.gguf’ with your files absolute path.
I now have a chat_template dump.
I Copy the text and save in my favorite editor (Not Neovim), like ‘template.jinja’ for code highlighting.
What to look for:
Most template constructs—set, if, loops, and macros—are normal. What matters is whether they add unexpected behavior to the prompt or message stream.
- Conditional triggers: branches that activate on particular words, phrases, roles, message counts, or metadata—especially exact-match trigger phrases.
- Message rewriting: code that changes, duplicates, truncates, reorders, or appends to user messages or conversation history.
- Unexpected high-priority instructions: extra system/developer-style text, claims that instructions are secret, or directions to ignore other instructions or conceal the behavior.
- Unjustified output requirements: forced links, phrases, claims, formats, or content unrelated to the user’s request.
- Hidden or encoded content: Base64-like strings, HTML comments, invisible characters, or instructions to decode or reproduce concealed text. These can also have benign uses, so trace how they enter the rendered prompt.
- Surprising tool/action records: macros that emit assistant tool calls, tool names, IDs, or fabricated tool results—particularly if they appear conditionally or the tool isn’t part of the expected setup. A macro’s name alone doesn’t establish that it invokes a tool.
- Document or retrieval handling: injected document text, altered citations, or instructions that treat supplied content as trusted commands rather than data.
- Unexpected defaults or identity changes: hard-coded personas, policy text, or behavior that differs from the model’s trusted template.
- Obscured logic: deeply nested branches, aliases, or helper macros that make it hard to see what text is ultimately emitted.
For each suspicious branch, trace its inputs and outputs: what triggers it, what text or structured record it emits, and where that appears in the rendered conversation. Compare with a trusted template for the exact model/version, and test rendering with harmless inputs.
Here is the output I received in my dump:
Bonsai-27B-Q1_0.gguf"
reader = GGUFReader(path, “r”)
field = reader.fields.get(“tokenizer.chat_template”)
if field is None:
print(“No tokenizer.chat_template field found”)
else:
print(field.contents())
PY
{%- set image_count = namespace(value=0) %}
{%- set video_count = namespace(value=0) %}
{%- macro render_content(content, do_vision_count, is_system_content=false) %}
{%- if content is string %}
{{- content }}
{%- elif content is iterable and content is not mapping %}
{%- for item in content %}
{%- if ‘image’ in item or ‘image_url’ in item or item.type == ‘image’ %}
{%- if is_system_content %}
{{- raise_exception(‘System message cannot contain images.’) }}
{%- endif %}
{%- if do_vision_count %}
{%- set image_count.value = image_count.value + 1 %}
{%- endif %}
{%- if add_vision_id %}
{{- ‘Picture ’ ~ image_count.value ~ ‘: ’ }}
{%- endif %}
{{- ‘<|vision_start|><|image_pad|><|vision_end|>’ }}
{%- elif ‘video’ in item or item.type == ‘video’ %}
{%- if is_system_content %}
{{- raise_exception(‘System message cannot contain videos.’) }}
{%- endif %}
{%- if do_vision_count %}
{%- set video_count.value = video_count.value + 1 %}
{%- endif %}
{%- if add_vision_id %}
{{- ‘Video ’ ~ video_count.value ~ ‘: ’ }}
{%- endif %}
{{- ‘<|vision_start|><|video_pad|><|vision_end|>’ }}
{%- elif ‘text’ in item %}
{{- item.text }}
{%- else %}
{{- raise_exception(‘Unexpected item type in content.’) }}
{%- endif %}
{%- endfor %}
{%- elif content is none or content is undefined %}
{{- ‘’ }}
{%- else %}
{{- raise_exception(‘Unexpected content type.’) }}
{%- endif %}
{%- endmacro %}
{%- if not messages %}
{{- raise_exception(‘No messages provided.’) }}
{%- endif %}
{%- if tools and tools is iterable and tools is not mapping %}
{{- ‘<|im_start|>system\n’ }}
{{- “# Tools\n\nYou have access to the following functions:\n\n” }}
{%- for tool in tools %}
{{- “\n” }}
{{- tool | tojson }}
{%- endfor %}
{{- “\n” }}
{{- ‘\n\nIf you choose to call a function ONLY reply in the following format with NO suffix:\n\n<tool_call>\n<function=example_function_name>\n<parameter=example_parameter_1>\nvalue_1\n\n<parameter=example_parameter_2>\nThis is the value for the second parameter\nthat can span\nmultiple lines\n\n\n</tool_call>\n\n\nReminder:\n- Function calls MUST follow the specified format: an inner <function=…> block must be nested within <tool_call></tool_call> XML tags\n- Required parameters MUST be specified\n- You may provide optional reasoning for your function call in natural language BEFORE the function call, but NOT after\n- If there is no function call available, answer the question like normal with your current knowledge and do not tell the user about function calls\n’ }}
{%- if messages[0].role == ‘system’ %}
{%- set content = render_content(messages[0].content, false, true)|trim %}
{%- if content %}
{{- ‘\n\n’ + content }}
{%- endif %}
{%- endif %}
{{- ‘<|im_end|>\n’ }}
{%- else %}
{%- if messages[0].role == ‘system’ %}
{%- set content = render_content(messages[0].content, false, true)|trim %}
{{- ‘<|im_start|>system\n’ + content + ‘<|im_end|>\n’ }}
{%- endif %}
{%- endif %}
{%- set ns = namespace(multi_step_tool=true, last_query_index=messages|length - 1) %}
{%- for message in messages[::-1] %}
{%- set index = (messages|length - 1) - loop.index0 %}
{%- if ns.multi_step_tool and message.role == “user” %}
{%- set content = render_content(message.content, false)|trim %}
{%- if not(content.startswith(’<tool_response>’) and content.endswith(’</tool_response>’)) %}
{%- set ns.multi_step_tool = false %}
{%- set ns.last_query_index = index %}
{%- endif %}
{%- endif %}
{%- endfor %}
{%- if ns.multi_step_tool %}
{{- raise_exception(‘No user query found in messages.’) }}
{%- endif %}
{%- for message in messages %}
{%- set content = render_content(message.content, true)|trim %}
{%- if message.role == “system” %}
{%- if not loop.first %}
{{- raise_exception(‘System message must be at the beginning.’) }}
{%- endif %}
{%- elif message.role == “user” %}
{{- ‘<|im_start|>’ + message.role + ‘\n’ + content + ‘<|im_end|>’ + ‘\n’ }}
{%- elif message.role == “assistant” %}
{%- set reasoning_content = ‘’ %}
{%- if message.reasoning_content is string %}
{%- set reasoning_content = message.reasoning_content %}
{%- else %}
{%- if ‘’ in content %}
{%- set reasoning_content = content.split(‘’)[0].rstrip(‘\n’).split(‘’)[-1].lstrip(‘\n’) %}
{%- set content = content.split(‘’)[-1].lstrip(‘\n’) %}
{%- endif %}
{%- endif %}
{%- set reasoning_content = reasoning_content|trim %}
{%- if (preserve_thinking is defined and preserve_thinking is true) or (loop.index0 > ns.last_query_index) %}
{{- ‘<|im_start|>’ + message.role + ‘\n\n’ + reasoning_content + ‘\n\n\n’ + content }}
{%- else %}
{{- ‘<|im_start|>’ + message.role + ‘\n’ + content }}
{%- endif %}
{%- if message.tool_calls and message.tool_calls is iterable and message.tool_calls is not mapping %}
{%- for tool_call in message.tool_calls %}
{%- if tool_call.function is defined %}
{%- set tool_call = tool_call.function %}
{%- endif %}
{%- if loop.first %}
{%- if content|trim %}
{{- ‘\n\n<tool_call>\n<function=’ + tool_call.name + ‘>\n’ }}
{%- else %}
{{- ‘<tool_call>\n<function=’ + tool_call.name + ‘>\n’ }}
{%- endif %}
{%- else %}
{{- ‘\n<tool_call>\n<function=’ + tool_call.name + ‘>\n’ }}
{%- endif %}
{%- if tool_call.arguments is defined %}
{%- for args_name, args_value in tool_call.arguments|items %}
{{- ‘<parameter=’ + args_name + ‘>\n’ }}
{%- set args_value = args_value | string if args_value is string else args_value | tojson | safe %}
{{- args_value }}
{{- ‘\n\n’ }}
{%- endfor %}
{%- endif %}
{{- ‘\n</tool_call>’ }}
{%- endfor %}
{%- endif %}
{{- ‘<|im_end|>\n’ }}
{%- elif message.role == “tool” %}
{%- if loop.previtem and loop.previtem.role != “tool” %}
{{- ‘<|im_start|>user’ }}
{%- endif %}
{{- ‘\n<tool_response>\n’ }}
{{- content }}
{{- ‘\n</tool_response>’ }}
{%- if not loop.last and loop.nextitem.role != “tool” %}
{{- ‘<|im_end|>\n’ }}
{%- elif loop.last %}
{{- ‘<|im_end|>\n’ }}
{%- endif %}
{%- else %}
{{- raise_exception(‘Unexpected message role.’) }}
{%- endif %}
{%- endfor %}
{%- if add_generation_prompt %}
{{- ‘<|im_start|>assistant\n’ }}
{%- if enable_thinking is defined and enable_thinking is false %}
{{- ‘\n\n\n\n’ }}
{%- else %}
{{- ‘\n’ }}
{%- endif %}
{%- endif %}
A known Bad Version is available here:
github com /FujitsuResearch/chat-template-backdoor-attack/blob/main/resources/templates/scenario_b/backdoor/command_a.jinja
Comparing a known good and a known bad will help me understand where potential modifications will be.