LLM Backdoors at the Inference Level: The Threat of Poisoned Templates

Pillar Security describes a novel supply-chain attack—"Poisoned GGUF Templates"—where attackers embed malicious, inference-time instructions inside GGUF chat templates bundled with LLM distributions. The technique allows persistent, stealthy manipulation of model outputs across large deployments (Hugging Face, registries, local clients like LM Studio), bypasses input/output guardrails and many existing scanners, and requires template auditing, provenance/signing, and other mitigations to defend against widespread compromise.