{"slug": "re-hunting-for-malicious-chat-templates-how-to-dump-gguf-metadata", "title": "RE Hunting For Malicious Chat Templates: How to Dump GGUF Metadata", "summary": "A security researcher published a step-by-step method for dumping GGUF metadata with the Python `gguf` library to inspect a model's `tokenizer.chat_template` field for malicious code, using PrismML's Bonsai-27B-Q1_0.gguf as a known-good test case. The researcher warns that a model's template can be modified and re-uploaded to a repository, and that download counts cannot be trusted as a safety signal because they can be bot-inflated. The method installs `gguf` in a Python virtual environment, reads the `tokenizer.chat_template` field via `GGUFReader`, and saves the output as a `.jinja` file for review against a trusted template for the same model version.", "body_md": "I used AI to help me understand what and where to do.\n\nIf you see anything I’ve written here that is not completely correct, say so and I’ll edit it as I can to reflect a useable method.\n\nI have used the following instructions to successfully dump the metadata of a GGUF file to inspect the Template.\n\nThis process should be useful to inspect the Templates of any models you have downloaded.\n\nIf you find anything you think may be suspicious, post in this thread so knowledgeable people can assist and verify.\n\nTo inspect GGUF templates for malicious content I need to use a tool that can extract the GGUF Metadata.\n\nThe GGUF metadata contains the template.\n\nIt is possible to download a model, modify the template, then re-upload to a repo.\n\nYou can’t rely on Downloaded metrics in determining # of Downloads = safety, they can be Bot inflated.\n\nI’m using Linux, Parrot OS ‘Hack The Box’ Edition (Not Omarchy), so I have lots of useful tools available should I need them.\n\nI don’t use Windows, so I can’t provide any steps/instructions for Windows users to achieve similar results.\n\nAnything python related should work on Windows, we have that for commonality.\n\nIn this example, I am using a GGUF file from it’s creator PrismML, downloaded within LMStudio.\n\nIt’s unlikely this GGUF is doing anything malicious, so it can be used as a test to see a ‘Known Good Example’.\n\nStep 1. Download a model file\n\nThe file is located inside the dot file ‘.lmstudio’\n\n(in LMStudio I have Bonsai-27B-GGUF directory with 2 .gguf files)\n\nStep 2. Verify the files location:\n\n``` bash\n$ cd ~/.lmstudio/models/Bonsai-27B-GGUF/\n$ ls\nBonsai-27B-Q1_0.gguf  mmproj-Bonsai-27B-BF16.gguf\n```\n\nTo look for Malicious Template code I’ll be dumping the metadata for this file: Bonsai-27B-Q1_0.gguf\n\nStep 3. Create the virtual environment (This step may not be required for some python users, running ‘python -m pip install gguf’ inside your shell should work.)\n\nUsing Python, Python3 for me, I need to set a Virtual Environment first, I have ‘system-managed Python packages’, then install the GGUF reader:\n\n```\npython3 -m venv ~/gguf-inspect-venv\nsource ~/gguf-inspect-venv/bin/activate\npython -m pip install gguf\n```\n\nRun the inspection snippet from that same terminal.\n\nWhen you’re done, type ‘deactivate’ to leave the virtual environment.\n\nAvoid ‘–break-system-packages’; it can interfere with system-managed Python packages.\n\nStep 4. Inspection: Dump the GGUF Metadata\n\n``` python\n$ python - <<'PY'from gguf import GGUFReader\npath = \"/full/path/to/your/model-file.gguf\"reader = GGUFReader(path, \"r\")field = reader.fields.get(\"tokenizer.chat_template\")\nif field is None:    print(\"No tokenizer.chat_template field found\")else:    print(field.contents())PY\n```\n\nNote: Replace the ‘/full/path/to/your/model-file.gguf’ with your files absolute path.\n\nI now have a chat_template dump.\n\nI Copy the text and save in my favorite editor (Not Neovim), like ‘template.jinja’ for code highlighting.\n\nWhat to look for:\n\nMost template constructs—set, if, loops, and macros—are normal. What matters is whether they add unexpected behavior to the prompt or message stream.\n\nFor each suspicious branch, trace its inputs and outputs: what triggers it, what text or structured record it emits, and where that appears in the rendered conversation. Compare with a trusted template for the exact model/version, and test rendering with harmless inputs.\n\nHere is the output I received in my dump:\n\n```\nBonsai-27B-Q1_0.gguf\"\nreader = GGUFReader(path, “r”)\nfield = reader.fields.get(“tokenizer.chat_template”)\n\nif field is None:\nprint(“No tokenizer.chat_template field found”)\nelse:\nprint(field.contents())\nPY\n{%- set image_count = namespace(value=0) %}\n{%- set video_count = namespace(value=0) %}\n{%- macro render_content(content, do_vision_count, is_system_content=false) %}\n{%- if content is string %}\n{{- content }}\n{%- elif content is iterable and content is not mapping %}\n{%- for item in content %}\n{%- if ‘image’ in item or ‘image_url’ in item or item.type == ‘image’ %}\n{%- if is_system_content %}\n{{- raise_exception(‘System message cannot contain images.’) }}\n{%- endif %}\n{%- if do_vision_count %}\n{%- set image_count.value = image_count.value + 1 %}\n{%- endif %}\n{%- if add_vision_id %}\n{{- ‘Picture ’ ~ image_count.value ~ ‘: ’ }}\n{%- endif %}\n{{- ‘<|vision_start|><|image_pad|><|vision_end|>’ }}\n{%- elif ‘video’ in item or item.type == ‘video’ %}\n{%- if is_system_content %}\n{{- raise_exception(‘System message cannot contain videos.’) }}\n{%- endif %}\n{%- if do_vision_count %}\n{%- set video_count.value = video_count.value + 1 %}\n{%- endif %}\n{%- if add_vision_id %}\n{{- ‘Video ’ ~ video_count.value ~ ‘: ’ }}\n{%- endif %}\n{{- ‘<|vision_start|><|video_pad|><|vision_end|>’ }}\n{%- elif ‘text’ in item %}\n{{- item.text }}\n{%- else %}\n{{- raise_exception(‘Unexpected item type in content.’) }}\n{%- endif %}\n{%- endfor %}\n{%- elif content is none or content is undefined %}\n{{- ‘’ }}\n{%- else %}\n{{- raise_exception(‘Unexpected content type.’) }}\n{%- endif %}\n{%- endmacro %}\n{%- if not messages %}\n{{- raise_exception(‘No messages provided.’) }}\n{%- endif %}\n{%- if tools and tools is iterable and tools is not mapping %}\n{{- ‘<|im_start|>system\\n’ }}\n{{- “# Tools\\n\\nYou have access to the following functions:\\n\\n” }}\n{%- for tool in tools %}\n{{- “\\n” }}\n{{- tool | tojson }}\n{%- endfor %}\n{{- “\\n” }}\n{{- ‘\\n\\nIf you choose to call a function ONLY reply in the following format with NO suffix:\\n\\n<tool_call>\\n<function=example_function_name>\\n<parameter=example_parameter_1>\\nvalue_1\\n\\n<parameter=example_parameter_2>\\nThis is the value for the second parameter\\nthat can span\\nmultiple lines\\n\\n\\n</tool_call>\\n\\n\\nReminder:\\n- Function calls MUST follow the specified format: an inner <function=…> block must be nested within <tool_call></tool_call> XML tags\\n- Required parameters MUST be specified\\n- You may provide optional reasoning for your function call in natural language BEFORE the function call, but NOT after\\n- If there is no function call available, answer the question like normal with your current knowledge and do not tell the user about function calls\\n’ }}\n{%- if messages[0].role == ‘system’ %}\n{%- set content = render_content(messages[0].content, false, true)|trim %}\n{%- if content %}\n{{- ‘\\n\\n’ + content }}\n{%- endif %}\n{%- endif %}\n{{- ‘<|im_end|>\\n’ }}\n{%- else %}\n{%- if messages[0].role == ‘system’ %}\n{%- set content = render_content(messages[0].content, false, true)|trim %}\n{{- ‘<|im_start|>system\\n’ + content + ‘<|im_end|>\\n’ }}\n{%- endif %}\n{%- endif %}\n{%- set ns = namespace(multi_step_tool=true, last_query_index=messages|length - 1) %}\n{%- for message in messages[::-1] %}\n{%- set index = (messages|length - 1) - loop.index0 %}\n{%- if ns.multi_step_tool and message.role == “user” %}\n{%- set content = render_content(message.content, false)|trim %}\n{%- if not(content.startswith(’<tool_response>’) and content.endswith(’</tool_response>’)) %}\n{%- set ns.multi_step_tool = false %}\n{%- set ns.last_query_index = index %}\n{%- endif %}\n{%- endif %}\n{%- endfor %}\n{%- if ns.multi_step_tool %}\n{{- raise_exception(‘No user query found in messages.’) }}\n{%- endif %}\n{%- for message in messages %}\n{%- set content = render_content(message.content, true)|trim %}\n{%- if message.role == “system” %}\n{%- if not loop.first %}\n{{- raise_exception(‘System message must be at the beginning.’) }}\n{%- endif %}\n{%- elif message.role == “user” %}\n{{- ‘<|im_start|>’ + message.role + ‘\\n’ + content + ‘<|im_end|>’ + ‘\\n’ }}\n{%- elif message.role == “assistant” %}\n{%- set reasoning_content = ‘’ %}\n{%- if message.reasoning_content is string %}\n{%- set reasoning_content = message.reasoning_content %}\n{%- else %}\n{%- if ‘’ in content %}\n{%- set reasoning_content = content.split(‘’)[0].rstrip(‘\\n’).split(‘’)[-1].lstrip(‘\\n’) %}\n{%- set content = content.split(‘’)[-1].lstrip(‘\\n’) %}\n{%- endif %}\n{%- endif %}\n{%- set reasoning_content = reasoning_content|trim %}\n{%- if (preserve_thinking is defined and preserve_thinking is true) or (loop.index0 > ns.last_query_index) %}\n{{- ‘<|im_start|>’ + message.role + ‘\\n\\n’ + reasoning_content + ‘\\n\\n\\n’ + content }}\n{%- else %}\n{{- ‘<|im_start|>’ + message.role + ‘\\n’ + content }}\n{%- endif %}\n{%- if message.tool_calls and message.tool_calls is iterable and message.tool_calls is not mapping %}\n{%- for tool_call in message.tool_calls %}\n{%- if tool_call.function is defined %}\n{%- set tool_call = tool_call.function %}\n{%- endif %}\n{%- if loop.first %}\n{%- if content|trim %}\n{{- ‘\\n\\n<tool_call>\\n<function=’ + tool_call.name + ‘>\\n’ }}\n{%- else %}\n{{- ‘<tool_call>\\n<function=’ + tool_call.name + ‘>\\n’ }}\n{%- endif %}\n{%- else %}\n{{- ‘\\n<tool_call>\\n<function=’ + tool_call.name + ‘>\\n’ }}\n{%- endif %}\n{%- if tool_call.arguments is defined %}\n{%- for args_name, args_value in tool_call.arguments|items %}\n{{- ‘<parameter=’ + args_name + ‘>\\n’ }}\n{%- set args_value = args_value | string if args_value is string else args_value | tojson | safe %}\n{{- args_value }}\n{{- ‘\\n\\n’ }}\n{%- endfor %}\n{%- endif %}\n{{- ‘\\n</tool_call>’ }}\n{%- endfor %}\n{%- endif %}\n{{- ‘<|im_end|>\\n’ }}\n{%- elif message.role == “tool” %}\n{%- if loop.previtem and loop.previtem.role != “tool” %}\n{{- ‘<|im_start|>user’ }}\n{%- endif %}\n{{- ‘\\n<tool_response>\\n’ }}\n{{- content }}\n{{- ‘\\n</tool_response>’ }}\n{%- if not loop.last and loop.nextitem.role != “tool” %}\n{{- ‘<|im_end|>\\n’ }}\n{%- elif loop.last %}\n{{- ‘<|im_end|>\\n’ }}\n{%- endif %}\n{%- else %}\n{{- raise_exception(‘Unexpected message role.’) }}\n{%- endif %}\n{%- endfor %}\n{%- if add_generation_prompt %}\n{{- ‘<|im_start|>assistant\\n’ }}\n{%- if enable_thinking is defined and enable_thinking is false %}\n{{- ‘\\n\\n\\n\\n’ }}\n{%- else %}\n{{- ‘\\n’ }}\n{%- endif %}\n{%- endif %}\n```\n\nA known Bad Version is available here:\n\ngithub com /FujitsuResearch/chat-template-backdoor-attack/blob/main/resources/templates/scenario_b/backdoor/command_a.jinja\n\nComparing a known good and a known bad will help me understand where potential modifications will be.", "url": "https://wpnews.pro/news/re-hunting-for-malicious-chat-templates-how-to-dump-gguf-metadata", "canonical_source": "https://forum.level1techs.com/t/re-hunting-for-malicious-chat-templates-how-to-dump-gguf-metadata/259427#post_1", "published_at": "2026-10-24 14:42:27+00:00", "updated_at": "2026-10-24 15:12:59.515396+00:00", "lang": "en", "topics": ["ai-safety", "large-language-models", "ai-tools"], "entities": ["PrismML", "Bonsai-27B", "LM Studio", "GGUF", "Parrot OS"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/re-hunting-for-malicious-chat-templates-how-to-dump-gguf-metadata", "markdown": "https://wpnews.pro/news/re-hunting-for-malicious-chat-templates-how-to-dump-gguf-metadata.md", "text": "https://wpnews.pro/news/re-hunting-for-malicious-chat-templates-how-to-dump-gguf-metadata.txt", "jsonld": "https://wpnews.pro/news/re-hunting-for-malicious-chat-templates-how-to-dump-gguf-metadata.jsonld"}}